Executive brief
Directus is a headless CMS platform that includes WebSocket support for real-time features. When WebSocket support is enabled, an attacker can send a specially crafted invalid WebSocket frame to crash the entire server, causing a denial of service. The server must be manually restarted to restore service, making this a trivial attack vector for any public Directus instance.
Technical details
This is an improper error handling vulnerability (CWE-755) in the WebSocket server component of Directus. When the server receives a malformed WebSocket frame with invalid RSV bits set, the underlying ws library throws an unhandled RangeError exception ("Invalid WebSocket frame: RSV2 and RSV3 must be clear"), crashing the entire Node.js process. The attack requires only network access to the WebSocket endpoint and no authentication; any unauthenticated attacker can send the malicious payload (a hex-encoded buffer containing "a180"). The fix is simple error handling: catch and properly handle frame validation errors instead of letting them propagate as unhandled exceptions. Patched in version 10.6.2.
Affected products
- Directus Directus >=10.4.0, <10.6.2
Timeline
- 2023-10-19: disclosed
- 2023-10-19: patched: Fixed in version 10.6.2