Junglewise Threat Intelligence

Directus sandbox escape in Run Script operation

Severity: low · CVSS 3.1 · Published 2023-09-15

Technologies: directus (npm). Vendors: Directus, npm.

Executive brief

Directus, a popular open-source data platform and headless CMS, is affected by a security vulnerability in its script execution engine. An attacker with high-level administrative privileges could bypass security restrictions to run unauthorized code on the underlying server. This could lead to a full system takeover, unauthorized data access, or disruption of services.

Technical details

Directus versions prior to 10.6.0 utilized the 'vm2' library to sandbox the 'Run Script' operation within its Flows feature. Due to a vulnerability in vm2 (specifically related to Promise handler sanitization), an attacker with sufficient privileges to create or edit flows can bypass the sandbox environment. This escape allows the execution of arbitrary code within the main Node.js context of the server. The issue was addressed in Directus v10.6.0 by migrating from the deprecated 'vm2' library to 'isolated-vm', which provides stronger isolation. Exploitation requires high privileges and specific user interaction/configuration.

Affected products

  • directus directus < 10.6.0

Timeline

  • 2023-07-12: advisory: Underlying vm2 vulnerability disclosed (GHSA-cchq-frgv-rjh5)
  • 2023-08-25: patched: Fix merged into Directus main branch via PR #19332
  • 2023-09-15: disclosed: Directus-specific security advisory published

References

Related threats