CVE-2024-39701
📋 TL;DR
This vulnerability in Directus allows broken access control when using _in or _nin operators with empty arrays. Attackers can bypass intended permission checks, potentially accessing unauthorized data. It affects Directus instances running versions 9.23.0 through 10.5.3.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Complete data exposure where attackers bypass all permission rules and access sensitive database content they shouldn't have access to.
Likely Case
Partial data leakage where attackers exploit specific permission rules to access unauthorized records or fields.
If Mitigated
Limited impact if proper network segmentation and additional authorization layers exist outside Directus.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker understands the permission rule structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.6.0
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-hxgm-ghmv-xjjm
Restart Required: Yes
Instructions:
1. Backup your Directus instance and database. 2. Update Directus to version 10.6.0 or later. 3. Restart the Directus service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Remove or modify vulnerable permission rules
allTemporarily disable or modify permission rules using _in or _nin operators until patching is possible.
🧯 If You Can't Patch
- Implement additional authorization checks at the application layer outside Directus
- Restrict network access to Directus instances and implement strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check Directus version via admin panel or API endpoint. If version is between 9.23.0 and 10.5.3 inclusive, the system is vulnerable.Check Version:
Check Directus admin panel or use API endpoint /server/infoVerify Fix Applied:
After updating to 10.6.0 or later, test permission rules with empty arrays to ensure they properly evaluate to false.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to restricted data
- Multiple failed permission checks followed by successful access
Network Indicators:
- Increased API requests to endpoints with permission rules
SIEM Query:
source="directus" AND (event="data_access" OR event="permission_check") AND result="success" WHERE user_role NOT IN expected_roles