Directus vulnerable to SSRF Loopback IP filter bypass
### Impact If you're relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`) ### Workaround You can block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-46990US | medium5.0 | — | ||
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass t… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/directus/directusPACKAGE
- https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91bWEB
- https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52WEB
- https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ffWEB
- https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431WEB
- https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2mWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-46990ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan