Executive brief
Directus is a popular open-source headless CMS and collaborative backend platform. An authenticated attacker could modify user presets to reassign them to other users by exploiting incomplete access control validation in the PATCH request handler, potentially allowing account takeover when combined with other vulnerabilities.
Technical details
The vulnerability is an improper access control issue (CWE-639) in Directus v10.13.0 affecting the presets feature. The application validates the user parameter during POST /presets requests but fails to apply the same validation during PATCH requests, allowing an authenticated attacker to modify presets and reassign them to other users. Attack requires authentication and user interaction (UI). The impact is limited to integrity (preset modification) but could escalate to account takeover when chained with CVE-2024-6533. This advisory is marked as a duplicate and has been withdrawn in favor of GHSA-3fff-gqw3-vj86.
Affected products
- Directus Directus up to 10.13.0
Timeline
- 2024-08-15: disclosed