Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user with file-upload rights can make the server fetch internal services through the /files/import endpoint and retrieve the response as a downloadable file.
This issue is fixed in version 12.0.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Monospace Directus
cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*
|
— |
12.0.0
|
References 4
https://github.com/directus/directus/commit/f75b25fa44b05c6022b20f231c20bc6e50f…
security-advisories@github.com
https://github.com/directus/directus/pull/27606
security-advisories@github.com
https://github.com/directus/directus/releases/tag/v12.0.0
security-advisories@github.com
https://github.com/directus/directus/security/advisories/GHSA-j5h6-vqc3-phqh
security-advisories@github.com