Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in Directus allows unauthorized access to data by bypassing permission checks through a specific type of connection. This could enable attackers to read, create, update, or delete records within user-defined collections. The main concern is confirming if your Directus deployment is affected and exposed.
- Attackers can bypass access controls.
- Critical data access is possible without authorization.
- Confirm Directus relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker can bypass authentication to access Directus by exploiting a vulnerability in public WebSocket connections. This is achieved by sending a malformed authentication message that causes the system to incorrectly process the authentication attempt, effectively granting the attacker access without a valid token. Once authenticated, the attacker can then perform unauthorized actions on user-defined data collections.
- Unauthenticated access to public WebSockets.
- Sending a failed authentication message.
- Unauthorized data access and modification.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could affect user data and system behavior by allowing unauthenticated attackers to bypass permission checks on public WebSocket connections. When supported by the advisory, attackers may read, create, update, or delete records in any user-defined collection.
- User data and records at risk.
- Bypass permission checks on public WebSockets.
- Unauthorized data access or modification.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Directus impacts systems using public-mode WebSocket connections, potentially allowing unauthenticated attackers to bypass permission checks and access or modify any user-defined data. Responsibility for addressing this likely falls to the platform or infrastructure teams managing the Directus deployment, in coordination with the application owners who define the data collections and user permissions. The first critical step is to identify all instances of Directus, confirm their exposure, and then assess the business criticality of each to prioritize remediation efforts, which may involve vendor coordination or implementing temporary risk reduction measures.
- Platform and application teams own the fix.
- Verify public WebSocket endpoint reachability.
- Plan remediation based on exposure and criticality.
