Executive brief
Directus is an open-source headless CMS and API platform used to manage and expose data. Versions through 9.22.4 allow attackers to bypass IP filtering on the file import feature through DNS rebinding attacks, enabling access to sensitive internal services (such as AWS metadata APIs) and data theft from private networks or cloud infrastructure.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the POST /files/import endpoint caused by a time-of-check-time-of-use (TOCTOU) race condition in DNS validation. The file import service validates a URL by performing DNS resolution and checking the resulting IP address against a deny list, but the attacker-controlled DNS server can return different IP addresses on subsequent resolutions during the actual file fetch. An authenticated attacker can exploit DNS rebinding to make the initial validation resolve to an allowlisted external IP, then cause the subsequent axios HTTP request to resolve to an internal IP (such as 127.0.0.1 or AWS metadata service at 169.254.169.254), bypassing the deny list protection from the prior CVE-2022-23080 patch. This allows exfiltration of data from internal servers or stealing cloud credentials. The issue was fixed in version 9.23.0.
Affected products
- Directus Directus <=9.22.4
Timeline
- 2023-03-03: disclosed
- 2023-03-03: patched: Fixed in v9.23.0