GHSA-fr3w-2p22-6w7p

Suggest an improvement
Source
https://github.com/advisories/GHSA-fr3w-2p22-6w7p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-fr3w-2p22-6w7p/GHSA-fr3w-2p22-6w7p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fr3w-2p22-6w7p
Aliases
Published
2024-03-12T20:50:48Z
Modified
2026-09-10T03:50:10Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
URL Redirection to Untrusted Site in OAuth2/OpenID in directus
Details

Summary

The authentication API has a redirect parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL https://docs.directus.io/reference/authentication.html#login-using-sso-providers /auth/login/google?redirect for example.

Details

There's a redirect that is done after successful login via the Auth API GET request to directus/auth/login/google?redirect=http://malicious-fishing-site.com, which I think is here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L394. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password.

PoC

Turn on any auth provider in Directus instance. Form a link to directus-instance/auth/login/:provider_id?redirect=http://malicious-fishing-site.com, login and get taken to malicious-site. Tested on the ory OAuth2 integration.

Impact

Users who login via OAuth2 into Directus.

Database specific 
{
    "cwe_ids":  [
        "CWE-601"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-03-12T20:50:48Z",
    "nvd_published_at":  "2024-03-12T21:15:59Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / directus

Package

Name
directus
View open source insights on deps.dev
Purl
pkg:npm/directus

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.10.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-fr3w-2p22-6w7p/GHSA-fr3w-2p22-6w7p.json"