CVE-2024-54128 - Directus HTML Injection Vulnerability in Comment Feature, Patched in Versions 10.13.4 and 11.2.

Directus is a popular real-time API and App dashboard for managing SQL database content, with notable features such as an intuitive interface and powerful customization options (Directus website). Among these features, Directus includes a Comment system that allows users to communicate with each other. To maintain security and prevent improper content, Directus has implemented a client-side filter that blocks certain restricted characters from being added as comments, specifically HTML tags.

Unfortunately, as of late, this filter has proven insufficient due to the possibility of bypassing it, rendering the application vulnerable to HTML Injection attacks. For the uninformed, HTML Injection is a technique that involves injecting malicious HTML code into a web application. When executed, the injected code can cause a variety of issues ranging from information theft to browser exploitation. It is highly concerning that attackers can take advantage of this vulnerability by injecting malicious code into comments and potentially compromising the Directus environment.

The good news is that Directus has addressed the issue and released patch updates in versions 10.13.4 and 11.2. (original security advisory).

Understanding the Vulnerability

When a user attempts to input a comment containing restricted characters or HTML tags, the client-side filter blocks the comment. This blocking is intended to prevent HTML Injection. However, an attacker can bypass this client-side filter by modifying the data sent to the server. With this manipulation, an attacker can inject malicious HTML code into comments.

Here's an example of a code snippet that could allow an attacker to perform the bypass

// Construct the payload with malicious HTML
const malicious_payload = "<script>alert('This is an HTML Injection attack!');</script>";

// Send the payload to the Directus server without the client-side filter
fetch("https://your-directus-instance.com/comments";, {
    method: "POST",
    headers: {
        "Content-Type": "application/json",
        "Authorization": "Bearer your_api_key"
    },
    body: JSON.stringify({
        comment: malicious_payload
    })
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error(error));

In this example, the malicious_payload variable contains a script that, once executed, will trigger an alert displaying the message "This is an HTML Injection attack!" With the bypass, the malicious code gets sent directly to the Directus server and bypasses the client-side filter. This code injection can lead to severe consequences depending on the attacker's intentions and can compromise the security and integrity of the environment.

Exploiting the Vulnerability

By successfully exploiting this vulnerability, an attacker could perform a wide range of attacks such as:

* Stealing sensitive data, including credentials and personal information
* Redirecting users to malicious websites or pages
* Modifying application content, potentially leading to defamation or harm to the company's reputation
* Exploiting other vulnerabilities that might lead to a complete system compromise

Solution

As previously mentioned, Directus has already addressed this issue and released security patches in versions 10.13.4 and 11.2.. To protect your Directus environment from this vulnerability, it is strongly advised to update your Directus instance to the latest version. You can find more information about upgrading Directus in the official documentation. Additionally, consider implementing server-side input validation and sanitization techniques to further protect against HTML Injection and other similar attacks.

Timeline

Published on: 12/05/2024 17:15:15 UTC
Last modified on: 12/05/2024 19:15:08 UTC