PT-2024-26913 · Directus · Directus

Zehir

·

Published

2024-06-03

·

Updated

2025-01-13

·

CVE-2024-36128

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Directus versions prior to 10.11.2
Description Directus is a real-time API and App dashboard for managing SQL database content. Providing a non-numeric length value to the random string generation utility will create a memory issue, breaking the capability to generate random strings platform-wide. This creates a denial of service situation where logged-in sessions can no longer be refreshed, as sessions depend on the capability to generate a random session ID. The issue can be triggered by accessing the "GET http://localhost:8055/utils/random/string" endpoint with a non-numeric length value, such as "foo". After this, all calls to "GET http://localhost:8055/utils/random/string" will return an empty string instead of a random string, causing authentication refreshes to fail for the app and API.
Recommendations To resolve the issue, update to version 10.11.2 or later. As a temporary workaround, consider restricting access to the vulnerable "utils/random/string" endpoint until a patch is available. Avoid using non-numeric length values in the length parameter of the affected API endpoint until the issue is resolved.

Exploit

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2024-36128
GHSA-632P-P495-25M5

Affected Products

Directus