Incorrect authorization in Directus - #VU158877

Vulnerability details

The vulnerability allows a remote user to retain unauthorized elevated access across REST and GraphQL HTTP requests outside the network permitted by an IP-restricted policy.

The vulnerability exists due to incorrect authorization in the Directus global access cache when cached access decisions are reused without accounting for the client's IP address. A remote user can obtain an elevated access result through the GraphQL WebSocket policy bypass and make subsequent REST or GraphQL HTTP requests as the same user to reuse the cached privileges outside the permitted network.

The cached bypass persists until the access-cache entry expires.

Affected software

Remediation

External References

• https://github.com/directus/directus/security/advisories/GHSA-jvxj-w2qp-5vmx

Related Security Bulletins

• Multiple vulnerabilities in Directus