CVE-2024-6533: Directus DOM-based XSS in layout_options

Executive brief

Directus is a content management system that allows teams to manage database content through a web interface. An authenticated user can inject malicious code into layout configuration settings that gets stored in the database and executed when other users view those layouts, potentially allowing attackers to steal session data or take over accounts.

Technical details

This is a DOM-based cross-site scripting (CWE-79) vulnerability in Directus's layout rendering system. An authenticated attacker can craft a malicious preset with XSS payload in the layout_options field (specifically in the "title" parameter of the cards layout), which is stored in the database and executed client-side when users view that layout. The attack bypasses Content Security Policy by wrapping the payload in an iframe with srcdoc attribute. Exploitation requires authentication and user interaction (victim must visit the affected view), but the vulnerability can be chained with CVE-2024-6534 (an unauthenticated bypass) to achieve account takeover without these preconditions. The vulnerability affects Directus versions prior to 11.3.3, which introduced proper input sanitization.

Affected products

• Directus Directus < 11.3.3

Timeline

• 2025-01-23: disclosed
• 2025-01-23: patched: Version 11.3.3 released with fix

References

• https://api.github.com/users/Amayyas
• https://github.com/Amayyas
• https://api.github.com/users/Amayyas/gists%7B/gist_id%7D
• https://api.github.com/users/Amayyas/repos
• https://avatars.githubusercontent.com/u/145337946?v=4
• https://api.github.com/users/Amayyas/events%7B/privacy%7D