Executive brief
Directus is a headless CMS that manages database content via WebSocket connections. When WebSocket authentication is configured to allow public access, unauthenticated users can subscribe to real-time database changes and perform create, read, update, and delete operations with full administrative privileges on any user-defined collection, exposing sensitive data like user credentials and personal information.
Technical details
The vulnerability is an authentication bypass in WebSocket handling where unauthenticated requests are assigned null accountability instead of public user permissions. This causes the system to incorrectly default to admin-level access rather than restricted public permissions when WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH are set to "public". An unauthenticated attacker on the network can exploit this by connecting to the WebSocket endpoint and executing CRUD operations (read, create, update, delete) or subscribing to mutations on any collection, bypassing normal permission checks. The fix involves using createDefaultAccountability() to ensure proper permission scoping for unauthenticated users. This affects Directus versions 11.0.0–11.2.x and 22.2.0–23.1.x; patches are available in 11.3.0 and 23.2.0.
Affected products
- Directus Directus 11.0.0 to 11.2.x; 22.2.0 to 23.1.x
Timeline
- 2024-12-09: disclosed: Advisory published (GHSA-849r-qrwj-8rv4, CVE-2024-54151)
- 2024-12-09: patched: Fixed in Directus 11.3.0 and @directus/api 23.2.0