Executive brief
Directus is a headless CMS platform used to manage and deliver digital content. An authorized user can crash the Directus service by modifying the filename_disk field to point to a folder and then accessing that file through the public assets endpoint, causing service unavailability.
Technical details
The vulnerability is an unhandled exception (CWE-755) triggered when an authorized user updates the filename_disk value on a file record to reference a folder instead of a file, then accesses that resource through the /assets endpoint. The root cause is insufficient input validation on the filename_disk field combined with missing error handling for invalid file access scenarios. The attack requires authenticated access with permissions to modify the filename_disk field on directus_files. Exploitation results in denial of service by aborting the Directus process. The vulnerability was patched in v9.15.0.
Affected products
- Directus Directus before 9.15.0
Timeline
- 2022-08-19: disclosed: Public disclosure via GitHub advisory
- 2022-08-30: patched: Patched in v9.15.0