Directus up to 10.9.x API GET Request google redirect

Summaryinfo

A vulnerability classified as problematic has been found in Directus up to 10.9.x. This affects an unknown function of the file directus/auth/login/google of the component API GET Request Handler. Performing a manipulation of the argument redirect results in redirect. This vulnerability is known as CVE-2024-28239. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Directus up to 10.9.x. It has been classified as problematic. This affects some unknown processing of the file directus/auth/login/google of the component API GET Request Handler. The manipulation of the argument redirect with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password. Users who login via OAuth2 into Directus may be at risk. This issue has been addressed in version 10.10.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was published 03/12/2024 as GHSA-fr3w-2p22-6w7p. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-28239 since 03/07/2024. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 10.10.0 eliminates this vulnerability. Applying the patch 5477d7d61babd7ffc2f835d399bf79611b15b203 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Directus

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8
• 10.9

License

• open-source

Website

• Product: https://github.com/directus/directus/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion