PT-2023-26483 · Directus · Directus

Madc · Published 2023-07-25 · Updated 2024-11-08 · CVE-2023-38503

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions 10.3.0 through 10.4.x

Description The issue concerns the improper checking of permission filters when using GraphQL subscriptions, resulting in unauthorized users receiving events they should not have access to. This affects any collection, including the directus users collection, which is configured with such a permissions filter by default. The problem arises when permissions rely on the $CURRENT USER variable for filtering.

Recommendations For versions 10.3.0 through 10.4.x, update to version 10.5.0 to resolve the issue. As a temporary workaround for affected versions, consider disabling GraphQL subscriptions to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-200

CWE-863

Related Identifiers

CVE-2023-38503

GHSA-GGGM-66RH-PP98

Affected Products

Directus

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38503.json · Exploit
• https://github.com/directus/directus/pull/19155 · Patch
• https://github.com/directus/directus/security/advisories/GHSA-gggm-66rh-pp98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38503 · Security Note
• https://osv.dev/vulnerability/GHSA-gggm-66rh-pp98 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38503 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://t.me/cibsecurity/67276 · Telegram Post
• https://t.me/cvenotify/55153 · Telegram Post
• https://twitter.com/graphqlweekly/status/1854931984197599706 · Twitter Post