-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided security advisory and the associated commit dad9576ea9362905cc4de8028d3877caff36dc23 clearly indicates an open redirect vulnerability in the SAML authentication flow of Directus. The vulnerability exists because the RelayState parameter in the SAML callback endpoint was not being validated against an allowlist of domains. The patch introduces a check using the isLoginRedirectAllowed function within the createSAMLAuthRouter function in the file api/src/auth/drivers/saml.ts. This function is responsible for creating the SAML authentication routes, including the vulnerable callback handler. The absence of this validation in versions prior to the patch is what makes the createSAMLAuthRouter function vulnerable, as it constructs the logic that improperly handles the RelayState parameter, leading to the open redirect.
createSAMLAuthRouterapi/src/auth/drivers/saml.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | < 11.14.0 | 11.14.0 |
| @directus/api | npm | < 32.1.1 | 32.1.1 |