-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | < 11.13.0 | 11.13.0 |
| @directus/api | npm | < 32.0.0 | 32.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in an observable difference in error messages returned by the Directus REST API when a user attempts to access a collection. A different error message was returned for a non-existent collection compared to an existing collection for which the user lacks permissions. This allowed an unauthenticated user to enumerate the names of collections in the Directus instance.
The analysis of the patch commit f99c9b89071f9d136cc9b0d0c182f2d24542bc31 reveals changes in three key files that were responsible for generating these inconsistent error messages:
api/src/middleware/collection-exists.ts: The collectionExists middleware would throw a generic ForbiddenError when a requested collection did not exist.api/src/permissions/modules/process-payload/process-payload.ts: The processPayload function would throw a more specific ForbiddenError with a detailed reason when a user lacked permissions for an action on an existing collection.api/src/permissions/modules/validate-access/validate-access.ts: Similarly, the validateAccess function would generate a specific error message for permission failures on existing collections.The patch rectifies this by introducing a centralized function, createCollectionForbiddenError, which generates a consistent error message regardless of whether the collection exists or the user simply lacks permission. By replacing the distinct ForbiddenError instantiations in the identified vulnerable functions, the patch eliminates the information leakage vector.
collectionExistsapi/src/middleware/collection-exists.ts
processPayloadapi/src/permissions/modules/process-payload/process-payload.ts
validateAccessapi/src/permissions/modules/validate-access/validate-access.ts
Ongoing coverage of React2Shell