// For flags

CVE-2024-39895

Directus GraphQL Field Duplication Denial of Service (DoS)

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.

Directus es una API y un panel de aplicaciones en tiempo real para administrar el contenido de la base de datos SQL. Un ataque de denegación de servicio (DoS) por duplicación de campos en GraphQL es un tipo de ataque en el que un atacante aprovecha la flexibilidad de GraphQL para abrumar a un servidor solicitando el mismo campo varias veces en una sola consulta. Esto puede hacer que el servidor realice cálculos redundantes y consuma recursos excesivos, lo que lleva a una denegación de servicio para usuarios legítimos. La solicitud al endpoint /graphql se envía al visualizar gráficos generados en un panel. Modificando los datos enviados y duplicando muchas veces los campos es posible un ataque DoS. Esta vulnerabilidad se solucionó en 10.12.0.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-07-02 CVE Reserved
  • 2024-07-08 CVE Published
  • 2024-07-09 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Directus
Search vendor "Directus"
Directus
Search vendor "Directus" for product "Directus"
< 10.12.0
Search vendor "Directus" for product "Directus" and version " < 10.12.0"
en
Affected