CVE-2023-26492

Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass the security controls by performing a DNS rebinding attack and view sensitive data from internal servers or perform a local port scan. An attacker can exploit this vulnerability to access highly sensitive internal server(s) and steal sensitive information. This issue was fixed in version 9.23.0.

CVSS v3.0 7.5 HIGH

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h	Exploit Third Party Advisory
https://github.com/directus/directus/commit/ff53d3e69a602d05342e15d9bb616884833ddbff	Patch
https://github.com/directus/directus/releases/tag/v9.23.0	Release Notes

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*

Information

Published : 2023-03-03 14:15

Updated : 2023-03-10 06:55

NVD link : CVE-2023-26492

Mitre link : CVE-2023-26492

JSON object : View

CWE

CWE-918

Server-Side Request Forgery (SSRF)

Advertisement

Products Affected

monospace

directus

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h", "name": "https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/directus/directus/commit/ff53d3e69a602d05342e15d9bb616884833ddbff", "name": "https://github.com/directus/directus/commit/ff53d3e69a602d05342e15d9bb616884833ddbff", "tags": ["Patch"], "refsource": "MISC"}, {"url": "https://github.com/directus/directus/releases/tag/v9.23.0", "name": "https://github.com/directus/directus/releases/tag/v9.23.0", "tags": ["Release Notes"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass the security controls by performing a DNS rebinding attack and view sensitive data from internal servers or perform a local port scan. An attacker can exploit this vulnerability to access highly sensitive internal server(s) and steal sensitive information. This issue was fixed in version 9.23.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-918"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-26492", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}}, "publishedDate": "2023-03-03T22:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.23.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-03-10T14:55Z"}