CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39895 – Directus GraphQL Field Duplication Denial of Service (DoS)
https://notcve.org/view.php?id=CVE-2024-39895
Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. • https://github.com/directus/directus/commit/543b345695071c1de61a35004bd063fe59dba0c8 https://github.com/directus/directus/security/advisories/GHSA-7hmh-pfrp-vcx4 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39701 – Directus Incorrectly handles _in` filter
https://notcve.org/view.php?id=CVE-2024-39701
Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the **values**. This vulnerability is fixed in 10.6.0. • https://github.com/directus/directus/security/advisories/GHSA-hxgm-ghmv-xjjm • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36128 – Directus is soft-locked by providing a string value to random string util
https://notcve.org/view.php?id=CVE-2024-36128
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2. Directus es una API y un panel de aplicaciones en tiempo real para administrar el contenido de la base de datos SQL. • https://github.com/directus/directus/commit/7d2a1392f43613094de700062aba168a9400dd3b https://github.com/directus/directus/security/advisories/GHSA-632p-p495-25m5 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34709 – Directus Lacks Session Tokens Invalidation
https://notcve.org/view.php?id=CVE-2024-34709
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. This vulnerability is fixed in 10.11.0. • https://github.com/directus/directus/commit/a6172f8a6a0f31a6bf4305a090de172ebfb63bcf https://github.com/directus/directus/security/advisories/GHSA-g65h-35f3-x2w3 • CWE-613: Insufficient Session Expiration •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34708 – Directus allows redacted data extraction on the API through "alias"
https://notcve.org/view.php?id=CVE-2024-34708
Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field. This can be avoided by removing permission to view the sensitive fields entirely from users or roles that should not be able to see them. • https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •