Executive brief
Directus is a headless CMS platform that manages database content and user access. Session tokens are not properly invalidated after logout; if an attacker captures a session token (e.g., from browser history on a shared computer), they can use it to access the system for up to 24 hours even after the legitimate user logs out, potentially gaining access to sensitive content and administrative functions.
Technical details
This vulnerability is a session expiration flaw (CWE-613) affecting Directus versions 10.10.0 through 10.10.x. When users log out, the directus_session record is destroyed and the HTTP cookie is deleted, but the underlying JWT session token remains valid until its expiry time (default 1 day). An attacker who captures the JWT token value can authenticate without the directus_session check, bypassing the intended stateful session invalidation. The attack requires low privileges (authenticated user context) and user interaction to obtain a valid token, but once captured, the token provides unauthorized access. The fix, released in version 10.11.0, ensures that session token validation checks both the JWT's cryptographic validity and the existence and validity of the associated directus_session record.
Affected products
- Directus Directus 10.10.0 to 10.10.x
Timeline
- 2024-05-13: disclosed
- 2024-05-13: patched: Fixed in version 10.11.0