SB20240312363 - Multiple vulnerabilities in Directus

Description

This security bulletin contains information about 2 vulnerabilities.

1) Use of GET Request Method With Sensitive Query Strings (CVE-ID: CVE-2024-28238)

CWE-ID: CWE-598 - Information Exposure Through Query Strings in GET Request

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to use of get request method with sensitive query strings in the /files page when passing a jwt via a get request. A local privileged user can access logged urls containing the session token to disclose sensitive information.

URLs may be stored in web server logs and browser history, which can expose active session tokens.

2) Open redirect (CVE-ID: CVE-2024-28239)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to redirect users to an untrusted site.

The vulnerability exists due to url redirection to untrusted site in the authentication API redirect parameter when handling OAuth2/OpenID login requests. A remote attacker can send a crafted login link with a malicious redirect parameter to redirect users to an untrusted site.

User interaction is required, and the issue affects users logging in via OAuth2/OpenID providers.

Remediation

Install update from vendor's website.

References

• https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677
• https://github.com/directus/directus/security/advisories/GHSA-fr3w-2p22-6w7p
• https://github.com/advisories/GHSA-fr3w-2p22-6w7p