Log in Start free

Vulnerability · Published Sep 18, 2024 · Assigned by GitHub_M

CVE-2024-46990SSRF Loopback IP filter bypass in directus

Medium 5.0

In plain English

A medium-severity improper access control in directus from directus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.5%top 59.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@directus/api21.0.0GHSA-68g8-c275-xf2m
npm@directus/api22.1.1GHSA-68g8-c275-xf2m
npmdirectus10.13.3GHSA-68g8-c275-xf2m
npmdirectus11.1.0GHSA-68g8-c275-xf2m

Affected products (as reported)

VendorProductVersions
directus directus < 10.13.3>= 11.0.0, < 11.1.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References