Executive brief
Directus is a popular open-source backend-as-a-service platform that provides data management and API capabilities. A flaw in its GraphQL subscription feature allows authenticated users to receive real-time event notifications for data they should not have permission to access, potentially exposing sensitive information such as other users' account details and activity logs.
Technical details
The vulnerability is a permission-checking flaw in GraphQL subscription handlers (CWE-200, CWE-863). Permission filters based on $CURRENT_USER are not properly enforced when processing subscription requests, allowing authenticated users to subscribe to events on collections they lack read permissions for. The default directus_users collection is particularly affected, enabling attackers to receive mutation events containing sensitive fields like user IDs, last access times, and page activity. Exploitation requires network access and a valid user account with any privilege level, plus user interaction to initiate the subscription. A patch is available in version 10.5.0; prior versions 10.3.0–10.4.x are affected. A workaround is to disable GraphQL subscriptions.
Affected products
- Directus Directus 10.3.0 to 10.4.x
Timeline
- 2023-07-25: disclosed
- 2023-07-25: patched: Version 10.5.0 includes fix (PR #19155)