Executive brief
Directus is a popular open-source headless CMS and API platform. An authenticated attacker can send a specially crafted GraphQL query that duplicates fields multiple times, causing the server to consume excessive CPU and memory resources, rendering the service unresponsive for minutes at a time. Repeated attacks could make the platform unavailable to all legitimate users.
Technical details
This is a denial-of-service vulnerability exploiting uncontrolled resource consumption in Directus GraphQL query processing (CWE-400). An authenticated user can craft a GraphQL query to the /graphql endpoint that duplicates fields (such as "max" and "id") hundreds of times, forcing the server to perform redundant computation and exhaust CPU/memory. The attack requires valid authentication credentials and network access to the GraphQL endpoint. Exploitation causes the service to become unresponsive for several minutes; repeated attacks could render it indefinitely unavailable. The vulnerability was patched in Directus 10.12.0.
Affected products
- Directus Directus < 10.12.0
Timeline
- 2024-07-08: disclosed
- 2024-07-08: patched: Fixed in version 10.12.0