Quick answers
- Is CVE-2024-6533 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-6533 being exploited in the wild.
- How severe is CVE-2024-6533?
- Low severity, with a CVSS score of 3.4, published 23 January 2025.
- Which products and versions are affected?
- directus (npm) < 11.3.3, SEMVER:introduced=0,fixed=11.3.3.
- Is there a fix for CVE-2024-6533?
- Yes. directus (npm): upgrade to 11.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-6533 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2024-6533?
- Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- directus (npm): upgrade to 11.3.3 or later
npm install directus@11.3.3
Technical details
This is a DOM-based cross-site scripting (CWE-79) vulnerability in Directus's layout rendering system. An authenticated attacker can craft a malicious preset with XSS payload in the layout_options field (specifically in the "title" parameter of the cards layout), which is stored in the database and executed client-side when users view that layout. The attack bypasses Content Security Policy by wrapping the payload in an iframe with srcdoc attribute. Exploitation requires authentication and user interaction (victim must visit the affected view), but the vulnerability can be chained with CVE-2024-6534 (an unauthenticated bypass) to achieve account takeover without these preconditions. The vulnerability affects Directus versions prior to 11.3.3, which introduced proper input sanitization.
Affected products
- Directus Directus < 11.3.3
Identifiers
- CVE-2024-6533
- GHSA-9qrm-48qf-r2rw
Timeline
- 2025-01-23: disclosed
- 2025-01-23: patched: Version 11.3.3 released with fix