Executive brief
Directus, a popular headless CMS and content management API platform, had overly permissive default values for Cross-Origin Resource Sharing (CORS) settings. This could allow attackers from unauthorized origins to make requests to a Directus instance if administrators did not manually configure stricter CORS policies. In production environments where default settings were left unchanged, this creates a potential pathway for data theft, unauthorized modifications, or service disruption.
Technical details
The vulnerability stems from insecure default values in the CORS_ENABLED and CORS_ORIGIN configuration parameters in Directus. By default, these settings were configured permissively, allowing cross-origin requests from unauthorized sources without explicit administrator configuration. An attacker can exploit this by crafting malicious cross-origin requests from an untrusted domain to access or modify sensitive data, assuming the target deployment has not customized the CORS settings. This is a configuration-based vulnerability that requires user interaction (victim accessing a malicious page) and occurs when CORS restrictions are improperly scoped. The vulnerability was patched in version 9.7.0 (PR #12022) by changing the default CORS configuration to be more restrictive.
Affected products
- Directus Directus before 9.7.0
Timeline
- 2022-04-05: disclosed
- 2022-04-05: patched: Fixed in version 9.7.0