Executive brief
Directus is a data platform used to manage databases and content through a visual interface. A security flaw allows a logged-in user to modify their own interface settings (presets) and then reassign those settings to a different user. If combined with other vulnerabilities, this could potentially lead to an attacker gaining control over another user's account or manipulating what they see in the management dashboard.
Technical details
An Insecure Direct Object Reference (IDOR) exists in Directus v10.13.0 and v10.13.1. While the application validates the 'user' parameter during the initial creation of a preset (POST /presets), it fails to perform the same validation during an update (PATCH /presets/{id}). An authenticated attacker can create a preset, then use a PATCH request to change the 'user' field to a victim's ID. This allows the attacker to inject malicious configurations into another user's view. When chained with other vulnerabilities like CVE-2024-6533, this can lead to account takeover. The issue is fixed in version 10.13.2.
Affected products
- Directus directus <= 10.13.1
Timeline
- 2024-08-15: advisory: NVD Published Date
- 2024-08-27: disclosed: GitHub Advisory published
- 2024-08-27: patched: Fix released in version 10.13.2