CVE-2024-46990
📋 TL;DR
This vulnerability in Directus allows attackers to bypass localhost access restrictions by using alternative loopback IP addresses like 127.0.0.2 instead of just 127.0.0.1. This affects Directus instances where administrators rely on default IP filtering to block localhost access. Users of vulnerable Directus versions are affected.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access restricted Directus functionality or data intended only for localhost access, potentially leading to unauthorized data exposure or privilege escalation.
Likely Case
Unauthorized users bypass intended access controls to reach admin interfaces or APIs that should only be accessible from localhost.
If Mitigated
With proper CIDR range blocking, all 127.x.x.x addresses are blocked, preventing the bypass entirely.
🎯 Exploit Status
Exploitation requires knowledge of the vulnerability and ability to access the Directus instance from a network perspective
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.13.3 or 11.1.0
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m
Restart Required: Yes
Instructions:
1. Backup your Directus instance and database. 2. Update Directus to version 10.13.3 or 11.1.0 using your package manager. 3. Restart the Directus service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Block 127.0.0.0/8 CIDR range
allManually configure IP filtering to block the entire 127.x.x.x loopback range instead of just 127.0.0.1
Configure your firewall or application settings to block 127.0.0.0/8
🧯 If You Can't Patch
- Implement network-level firewall rules to block all 127.x.x.x addresses from accessing the Directus instance
- Use application-level middleware to validate and reject requests from any 127.x.x.x IP address
🔍 How to Verify
Check if Vulnerable:
Check if your Directus version is below 10.13.3 or 11.1.0 and if you have IP filtering configured for localhostCheck Version:
directus version or check package.json for version numberVerify Fix Applied:
After updating, test that requests from 127.0.0.2 or other 127.x.x.x addresses are properly blocked📡 Detection & Monitoring
Log Indicators:
- Access attempts from 127.x.x.x addresses other than 127.0.0.1
- Failed authentication or authorization attempts from loopback addresses
Network Indicators:
- Traffic to Directus from 127.x.x.x IPs
- Unusual access patterns from localhost variants
SIEM Query:
source_ip:/127\.\d+\.\d+\.\d+/ AND dest_port:8055 AND (app:"directus" OR user_agent:"Directus")🔗 References
- https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b
- https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52
- https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff
- https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431
- https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m
