CVE-2024-45596: Directus session caching vulnerability in OpenID and OAuth2

CVE-2024-45596 · Severity: low · CVSS 3.1 · Published 2024-09-10

Directus is a headless CMS platform that allows authentication via OpenID and OAuth2 protocols. When caching is enabled and the authentication URL omits the redirect parameter, the system incorrectly caches authenticated user credentials. An unauthenticated attacker can retrieve the cached credentials of the last user who logged in, gaining unauthorized access to their account and data.

Technologies: @directus/api (npm), directus (npm). Vendors: npm.

Quick answers

Is CVE-2024-45596 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-45596 being exploited in the wild.
How severe is CVE-2024-45596?
Low severity, with a CVSS score of 3.1, published 10 September 2024.
Which products and versions are affected?
@directus/api (npm) SEMVER:introduced=0,fixed=21.0.1; directus (npm) SEMVER:introduced=0,fixed=10.13.3.
Is there a fix for CVE-2024-45596?
Yes. @directus/api (npm): upgrade to 21.0.1 or later; directus (npm): upgrade to 10.13.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45596 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-45596?
Check whether you run @directus/api (npm) or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @directus/api (npm): upgrade to 21.0.1 or later
    npm install @directus/api@21.0.1
  • directus (npm): upgrade to 10.13.3 or later
    npm install directus@10.13.3

Technical details

The vulnerability exists in the OpenID and OAuth2 authentication drivers (openid.ts and oauth2.ts), which rely on the respond middleware for response caching. The middleware caches GET requests based on certain conditions but fails to exclude unauthenticated requests that return sensitive user credentials (access tokens). When a user logs in via an SSO callback URL without a redirect query parameter and caching is enabled, the response containing the user's access token is cached. Subsequent unauthenticated requests to the same callback URL return the cached credentials, allowing session hijacking. This requires cache to be enabled and affects all versions of directus before 10.13.3, 11.1.0, and @directus/api before 21.0.1 and 22.2.0. The attack is network-accessible, requires user interaction (a victim must log in first), and results in credential disclosure to an unauthenticated attacker.

Affected products

  • Directus directus <=10.13.2, 11.0.0-rc.1 to <=11.0.2
  • Directus @directus/api all versions up to <21.0.1, 22.0.0 to <22.2.0

Identifiers

  • CVE-2024-45596
  • GHSA-cff8-x7jv-4fm8

Timeline

  • 2024-09-10: disclosed: CVE-2024-45596 published
  • 2024-09-10: patched: Patches released: directus 10.13.3, 11.1.0; @directus/api 21.0.1, 22.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.