Description
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| directus | directus | < 12.1.0 | 12.1.0 |
References
- GitHub Security Advisory (GHSA-97xr-jchp-xm3c) vendor-advisory
- https://github.com/directus/directus/commit/8d4cd86783bcbf5444eaf290e8dcecb33929300e patch
- Directus v12.1.0 Release Notes release-notes
- https://github.com/directus/directus/blob/v12.0.2/api/src/websocket/controllers/base.ts#L381-L397 technical-description
- VulnCheck Advisory: Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface third-party-advisory