Executive brief
Directus is a popular open-source headless CMS and database management platform. The comment feature contains an HTML injection vulnerability where client-side input filters can be bypassed by sending malicious requests directly to the API, allowing authenticated attackers to inject arbitrary HTML and JavaScript. This could enable session hijacking or unauthorized actions performed on behalf of affected users.
Technical details
The comment feature implements input validation only on the client-side, which can be trivially bypassed by sending direct PATCH requests to the /activity/comment endpoint with HTML and script tags. The vulnerability is classified as CWE-80 (Basic XSS) and requires network access, low-level privileges (authenticated user), and user interaction (victim must view the injected comment). An attacker can inject malicious HTML, CSS, or JavaScript that executes in the context of other users' browsers when they view the comment, potentially exfiltrating sensitive data or performing actions on their behalf. Patches are available: versions 10.13.4 and 11.2.2 or later contain fixes.
Affected products
- Directus directus 10.10.0 through 10.13.3; 11.0.0-rc.1 through 11.2.1; 11.0.0 through 13.3.0
- Directus @directus/app 11.0.0 through 13.3.0
Timeline
- 2024-12-05: disclosed: Advisory published
- 2024-12-05: patched: Patches released in versions 10.13.4, 11.2.2, and 13.3.1