Is CVE-2022-26969 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-26969 being exploited in the wild.

How severe is CVE-2022-26969?

Low severity, with a CVSS score of 3.1, published 5 April 2022.

Which products and versions are affected?

directus (npm) SEMVER:introduced=0,fixed=9.7.0.

Is there a fix for CVE-2022-26969?

Yes. directus (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-26969 attacked?

It is attacked over the network.

Am I affected by CVE-2022-26969?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-26969: Directus insecure default CORS configuration

CVE-2022-26969 · Severity: low · CVSS 3.1 · Published 2022-04-05

Directus, a popular headless CMS and content management API platform, had overly permissive default values for Cross-Origin Resource Sharing (CORS) settings. This could allow attackers from unauthorized origins to make requests to a Directus instance if administrators did not manually configure stricter CORS policies. In production environments where default settings were left unchanged, this creates a potential pathway for data theft, unauthorized modifications, or service disruption.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2022-26969 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-26969 being exploited in the wild.
How severe is CVE-2022-26969?: Low severity, with a CVSS score of 3.1, published 5 April 2022.
Which products and versions are affected?: directus (npm) SEMVER:introduced=0,fixed=9.7.0.
Is there a fix for CVE-2022-26969?: Yes. directus (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-26969 attacked?: It is attacked over the network.
Am I affected by CVE-2022-26969?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 9.7.0 or later
```
npm install directus@9.7.0
```

Technical details

The vulnerability stems from insecure default values in the CORS_ENABLED and CORS_ORIGIN configuration parameters in Directus. By default, these settings were configured permissively, allowing cross-origin requests from unauthorized sources without explicit administrator configuration. An attacker can exploit this by crafting malicious cross-origin requests from an untrusted domain to access or modify sensitive data, assuming the target deployment has not customized the CORS settings. This is a configuration-based vulnerability that requires user interaction (victim accessing a malicious page) and occurs when CORS restrictions are improperly scoped. The vulnerability was patched in version 9.7.0 (PR #12022) by changing the default CORS configuration to be more restrictive.

Affected products

Directus Directus before 9.7.0

Identifiers

CVE-2022-26969
GHSA-g27j-74fp-xfpr

Timeline

2022-04-05: disclosed
2022-04-05: patched: Fixed in version 9.7.0

References

https://github.com/directus/directus/security/advisories/GHSA-g27j-74fp-xfpr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.