CVE-2024-27295
📋 TL;DR
This vulnerability in Directus allows attackers to hijack password reset emails by using email addresses with accented characters that MySQL/MariaDB treat as identical to the victim's email address. Attackers can reset victims' passwords and gain unauthorized access. All Directus instances using default MySQL/MariaDB configurations are affected.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the Directus dashboard, potentially compromising all database content and system integrity.
Likely Case
Attackers reset passwords for regular users, gaining unauthorized access to sensitive data and functionality.
If Mitigated
With proper email verification and monitoring, unauthorized access attempts are detected and blocked before successful exploitation.
🎯 Exploit Status
Exploitation requires only knowledge of victim email addresses and ability to register similar email addresses with accented characters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.8.3
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-qw9g-7549-7wg5
Restart Required: Yes
Instructions:
1. Backup your Directus instance and database. 2. Update Directus to version 10.8.3 or later. 3. Restart the Directus service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Change Database Collation
allModify MySQL/MariaDB collation to accent-sensitive for email columns
ALTER TABLE directus_users MODIFY email VARCHAR(255) COLLATE utf8mb4_bin;
Disable Password Reset
allTemporarily disable password reset functionality until patched
Modify Directus configuration to remove password reset endpoints
🧯 If You Can't Patch
- Implement additional email verification steps before allowing password resets
- Monitor logs for unusual password reset attempts from similar email addresses
🔍 How to Verify
Check if Vulnerable:
Check Directus version and database collation settings for email columnsCheck Version:
directus versionVerify Fix Applied:
Verify Directus version is 10.8.3 or later and test password reset functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed password reset attempts
- Password reset requests from email addresses with accented characters
Network Indicators:
- Unusual patterns of password reset API calls
SIEM Query:
source="directus" AND (event="password_reset_request" OR event="password_reset_success")