PT-2024-22353 · Directus · Directus

Rijkvanzanten · Published 2024-03-12 · Updated 2025-01-03 · CVE-2024-28238

Positive Technologies (AI Summary)

CVSS v3.1

2.3

Low

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 10.10.0

Description The issue concerns the inclusion of session tokens in URLs, specifically when reaching the "/files" page, where a JWT is passed via GET request. This poses a security risk as URLs are often logged in various places, such as web server logs and browser history. Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user.

Recommendations For versions prior to 10.10.0, upgrade to version 10.10.0 to address the issue. As a temporary workaround, consider restricting access to the "/files" page until the upgrade is applied. Avoid using the JWT token in the GET request to the "/files" page until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-598

Related Identifiers

CVE-2024-28238

GHSA-2CCR-G2RV-H677

Affected Products

Directus

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28238.json · Exploit
• https://github.com/directus/directus/security/advisories/GHSA-2ccr-g2rv-h677 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28238 · Security Note
• https://osv.dev/vulnerability/GHSA-2ccr-g2rv-h677 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/CVEnew/status/1767651270557360280 · Twitter Post
• https://t.me/cvenotify/106173 · Telegram Post