PT-2022-16894 · Directus · Directus

Highrijkvanzanten · Published 2022-04-04 · Updated 2022-04-12 · CVE-2022-24814

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Directus versions prior to 9.7.0

Description The issue allows unauthorized JavaScript to be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file, which loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, allowing the file to run any arbitrary JS.

Recommendations For versions prior to 9.7.0, update to version 9.7.0 to resolve the issue. As a temporary workaround, consider disabling the live embed in the what-you-see-is-what-you-get by adding { "media live embeds": false } to the Options Overrides option of the Rich Text HTML interface.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24814

GHSA-XMJJ-3C76-5W84

Affected Products

Directus

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24814.json · Exploit
• https://github.com/directus/directus/pull/12020 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24814 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24814 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xmjj-3c76-5w84 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/security/advisories/GHSA-xmjj-3c76-5w84 · Note
• https://github.com/directus/directus/releases/tag/v9.7.0 · Note
• https://t.me/cibsecurity/40117 · Telegram Post