Executive brief
Directus is a headless CMS platform that uses filter rules to control access to data based on user roles and permissions. A flaw in the `_in` and `_nin` filter operators causes them to incorrectly treat empty or null arrays as valid matches, allowing users to bypass access control rules and gain unauthorized access to data and functionality they should not be able to access.
Technical details
The vulnerability is an improper access control issue (CWE-284) in the `_in` and `_nin` filter operators in Directus versions 9.23.0 through 10.5.3. When a filter expression evaluates a field against an empty or null array (e.g., `{"role": {"_in": $CURRENT_USER.some_field}}` where `some_field` is null), the filter incorrectly evaluates to true instead of false. This requires the attacker to be authenticated with low privileges and have access to features that rely on these filters, such as the directus-extension-role-chooser. An attacker can exploit this to escalate their privileges or access resources beyond their intended permissions. The vulnerability was fixed in version 10.6.0.
Affected products
- Directus Directus >=9.23.0, <=10.5.3
Timeline
- 2024-07-08: disclosed
- 2024-07-08: patched: Fixed in version 10.6.0