-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | < 10.13.3 | 10.13.3 |
| directus | npm | >= 11.0.0, < 11.1.0 | 11.1.0 |
| @directus/api | npm | < 21.0.0 | 21.0.0 |
| @directus/api | npm | >= 22.0.0, < 22.1.1 | 22.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from incomplete loopback IP filtering. The commit diff shows the vulnerable function was modified to replace exact IP matching with CIDR range checks using the 'ip-matching' library. The original implementation in isDeniedIp.ts only checked for exact IP matches (info.address === ip), which failed to block the full 127.0.0.0/8 range. The patched version introduces CIDR range matching for internal interfaces, addressing the SSRF bypass. The test file changes confirm the vulnerability by adding tests for 127.x.x.x bypass scenarios that would have passed in the vulnerable version.