PT-2023-20682 · Directus · Directus

Ccamm + 1 · Published 2023-03-03 · Updated 2023-03-10 · CVE-2023-26492

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 9.23.0

Description Directus is a real-time API and App dashboard for managing SQL database content. It is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server via a POST request to the /files/import API endpoint. An attacker can bypass security controls by performing a DNS rebinding attack, allowing them to view sensitive data from internal servers or perform a local port scan. This can be exploited to access highly sensitive internal servers and steal sensitive information.

Recommendations For versions prior to 9.23.0, update to version 9.23.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /files/import API endpoint until the update is applied. Additionally, restricting the ability to import files from remote web servers can help minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-26492

GHSA-J3RG-3RGM-537H

Affected Products

Directus

References · 10

• 🔥 https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26492.json · Exploit
• https://github.com/directus/directus/commit/ff53d3e69a602d05342e15d9bb616884833ddbff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26492 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26492 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3rg-3rgm-537h · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/releases/tag/v9.23.0 · Note
• https://t.me/cvenotify/45492 · Telegram Post
• https://t.me/cibsecurity/59400 · Telegram Post