PT-2024-28714 · Directus · Directus

Highbr41Nslug · Published 2024-07-08 · Updated 2025-01-03 · CVE-2024-39896

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 10.13.0

Description The issue allows enumeration of existing SSO users in the instance when relying on SSO providers in combination with local authentication. This is possible because if an email address exists in Directus and belongs to a known SSO provider, it will throw a "helpful" error that the user belongs to another provider.

Recommendations For versions prior to 10.13.0, update to version 10.13.0 to resolve the issue. As a temporary workaround, consider disabling local login by setting the environment variable AUTH DISABLE DEFAULT to "true" when only using SSO for authentication.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-39896

GHSA-JGF4-VWC3-R46V

Affected Products

Directus

References · 12

• 🔥 https://github.com/directus/directus/security/advisories/GHSA-jgf4-vwc3-r46v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39896.json · Exploit
• https://github.com/directus/directus/commit/454cb534d6ffa547feb11f4d74b932ae7368dae2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-39896 · Security Note
• https://osv.dev/vulnerability/GHSA-jgf4-vwc3-r46v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39896 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://t.me/cvedetector/212 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1810411857846382782 · Twitter Post
• https://t.me/cvenotify/106182 · Telegram Post
• https://twitter.com/CVEnew/status/1810367941847748726 · Twitter Post
• https://twitter.com/cracbot/status/1811279350412742910 · Twitter Post