GitHub Advisoryadvisory · npm

GHSA-m5q3-8wgf-x8xf Directus vulnerable to extraction of password hashes through export querying

MEDIUM Published 2023-03-08 Modified 2023-03-08 Official page ↗
Aliases
CVE-2023-27481
Ecosystem
npm
Packages
directus
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-200
Reviewed
2023-03-08

Affected packages

• npm directus: < 9.16.0 → fixed in 9.16.0

Description

Impact Users with read access to the `password` field in `directus_users` can extract the argon2 password hashes by brute forcing the export functionality combined with a `_starts_with` filter. This allows the user to enumerate the password hashes. Patches The problem has been patched by preventing any hashed/concealed field to be filtered against with the `_starts_with` or other string operator. Workarounds Ensuring that no user has `read` access to the `password` field in `directus_users` is sufficient to prevent this vulnerability. For more information If you have any questions or comments about this advisory: • Open a Discussion in directus/directus • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2023-27481 Directus is a real-time API and App dashboard for managing SQL database content. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References