Horizon Alert
Summary of the vulnerability and why it matters
A security vulnerability has been identified in Directus, a platform used for managing SQL database content through a real-time API and dashboard. The issue, related to how login pages handle cross-origin requests, could allow attackers to intercept user authentication flows and potentially gain unauthorized access to user accounts linked to their authentication providers.
- Login pages can be tricked by other websites.
- Prevents unauthorized access to user accounts.
- Confirm Directus usage and assess potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker can leverage a vulnerability in Directus's Single Sign-On (SSO) login pages to hijack user authentication. By creating a malicious website that opens the Directus login page in a new window, the attacker can interfere with the OAuth authorization process. This allows them to redirect the user to an attacker-controlled client, tricking them into granting unauthorized access to their connected accounts, such as Google or Discord.
- Requires attacker-controlled website.
- Victim must click a link.
- Allows account takeover.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to redirect the OAuth authorization flow, causing users to unknowingly grant access to their authentication provider accounts when interacting with Directus login pages. This could occur when a malicious, cross-origin window opens the Directus login page.
- User authentication credentials
- Interception of OAuth authorization flow
- Unauthorized access to user accounts
Operational Fix
Recommended remediation, mitigation, and detection steps
The Directus platform's SSO login pages are vulnerable to cross-site scripting attacks that can lead to account compromise. The first step is to identify all Directus instances, determine their exposure, and confirm ownership. The platform team or the team managing the application that uses Directus for SSO should take the lead, followed by the security team for broader exposure analysis.
- Application and platform teams own resolution.
- Verify SSO integration reachability and criticality.
- Plan remediation during maintenance windows.
