PT-2023-26483 · Directus · Directus

Madc · Publicado 2023-07-25 · Atualizado 2024-11-08 · CVE-2023-38503

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions 10.3.0 through 10.4.x

Description The issue concerns the improper checking of permission filters when using GraphQL subscriptions, resulting in unauthorized users receiving events they should not have access to. This affects any collection, including the directus users collection, which is configured with such a permissions filter by default. The problem arises when permissions rely on the $CURRENT USER variable for filtering.

Recommendations For versions 10.3.0 through 10.4.x, update to version 10.5.0 to resolve the issue. As a temporary workaround for affected versions, consider disabling GraphQL subscriptions to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Incorrect Authorization

Enumeração de Fraquezas

CWE-200

CWE-863

Identificadores relacionados

CVE-2023-38503

GHSA-GGGM-66RH-PP98

Produtos afetados

Directus

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38503.json · Exploit
• https://github.com/directus/directus · Nota
• https://github.com/directus/directus/pull/19155 · Correção
• https://github.com/directus/directus/security/advisories/GHSA-gggm-66rh-pp98 · Aviso do Fabricante
• https://t.me/cibsecurity/67276 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-38503 · Nota de Segurança
• https://t.me/cvenotify/55153 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-gggm-66rh-pp98 · Aviso do Fabricante
• https://twitter.com/graphqlweekly/status/1854931984197599706 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-38503 · Aviso do Fabricante