GHSA-XMJJ-3C76-5W84

Vulnerability from github – Published: 2022-04-05 18:30 – Updated: 2022-04-05 18:30
VLAI?
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus
Details

Impact

Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS.

Patches

This was resolved in https://github.com/directus/directus/pull/12020 which is released in 9.7.0

Workarounds

You can disable the live embed in the WYSIWYG by adding { "media_live_embeds": false } to the Options Overrides option of the Rich Text HTML interface.

References

https://github.com/directus/directus/pull/12020

For more information

If you have any questions or comments about this advisory: * Open an issue in directus/directus * Email us at security@directus.io

Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "directus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24814"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-05T18:30:15Z",
    "nvd_published_at": "2022-04-04T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nUnauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS.\n\n### Patches\n\nThis was resolved in https://github.com/directus/directus/pull/12020 which is released in 9.7.0\n\n### Workarounds\n\nYou can disable the live embed in the WYSIWYG by adding `{ \"media_live_embeds\": false }` to the _Options Overrides_ option of the Rich Text HTML interface.\n\n### References\n\nhttps://github.com/directus/directus/pull/12020\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [directus/directus](https://github.com/directus/directus)\n* Email us at [security@directus.io](mailto:security@directus.io)\n",
  "id": "GHSA-xmjj-3c76-5w84",
  "modified": "2022-04-05T18:30:15Z",
  "published": "2022-04-05T18:30:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/security/advisories/GHSA-xmjj-3c76-5w84"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24814"
    },
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/pull/12020"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/directus/directus"
    },
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/releases/tag/v9.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) in directus"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.