Executive brief
Directus is an open-source headless CMS that provides data access control features to prevent certain network requests. The default security filter can be bypassed to access loopback addresses (localhost services) by using alternative loopback IP addresses like 127.0.0.2 instead of the typically-blocked 127.0.0.1, potentially exposing internal services to authenticated attackers.
Technical details
This is a Server-Side Request Forgery (SSRF) filter bypass vulnerability stemming from insufficient IP range validation. The vulnerability affects Directus's default 0.0.0.0 filter configuration, which only blocks 127.0.0.1 but fails to block the entire 127.0.0.0/8 loopback range (127.0.0.2–127.127.127.127). An authenticated attacker can exploit this by crafting requests to alternative loopback IPs to access internal services. The vulnerability requires authentication (PR:L) and network-level access, affecting confidentiality through potential exposure of internal service data. Patches are available in Directus 10.13.3, 11.1.0, and later versions; as a workaround, administrators can manually add the 127.0.0.0/8 CIDR range to their filter configuration.
Affected products
- Directus Directus ≤ 10.13.2; 11.0.0–11.0.x
- Directus @directus/api < 21.0.0; 22.0.0–22.1.0
Timeline
- 2024-09-18: disclosed
- 2024-09-18: patched: Directus 10.13.3, 11.1.0, @directus/api 21.0.0, 22.1.1