~ / search / GHSA-68g8-c275-xf2m

GHSA-68g8-c275-xf2m

Directus vulnerable to SSRF Loopback IP filter bypass

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-46990

Packages

EcosystemPackageAffectedFixed in
npm directus < 10.13.3 10.13.3
npm directus >= 11.0.0, < 11.1.0 11.1.0
npm @directus/api < 21.0.0 21.0.0
npm @directus/api >= 22.0.0, < 22.1.1 22.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact If you're relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`) ### Workaround You can block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.

References

External links from the advisory. They lead to third-party sites.