Executive brief
Directus is a headless CMS and database management platform. An attacker can exploit MySQL's default accent-insensitive string comparison to receive password reset emails intended for a victim user by registering a similar email address with accented characters. This allows unauthorized account takeover without needing the victim's password.
Technical details
The vulnerability is a logic flaw in the password reset mechanism combined with MySQL/MariaDB's default accent-insensitive and case-insensitive collation behavior. When a user requests a password reset, the API accepts an email address as input, performs a database lookup that matches accent-insensitive variants (e.g., 'julian@cure53.de' matches 'julian@cüre53.de'), but then sends the reset link to the user-supplied email address rather than the database-stored email. An attacker can register an accent-variant domain, request a password reset using the accented variant of the victim's email, receive the reset link, and gain account access. The attack requires network access and knowledge of the victim's email address. A patch is available in version 10.8.3.
Affected products
- Directus Directus <= 10.8.2
Timeline
- 2024-03-01: disclosed
- 2024-03-01: patched: Fix available in version 10.8.3