GitHub Advisoryadvisory · npm

GHSA-xmjj-3c76-5w84 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus

HIGH Published 2022-04-05 Modified 2022-04-05 Official page ↗
Aliases
CVE-2022-24814
Ecosystem
npm
Packages
directus
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-04-05

Affected packages

• npm directus: < 9.7.0 → fixed in 9.7.0

Description

Impact Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. Patches This was resolved in https://github.com/directus/directus/pull/12020 which is released in 9.7.0 Workarounds You can disable the live embed in the WYSIWYG by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface. References https://github.com/directus/directus/pull/12020 For more information If you have any questions or comments about this advisory: • Open an issue in directus/directus • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-24814 Directus is a real-time API and App dashboard for managing SQL database content. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References