CVE-2019-13979 : Exploit Details and Defense Strategies

Directus 7 API version 2.2.1 allows remote code execution through the uploads/_/originals directory due to the lack of measures to block PHP file uploads.

Understanding CVE-2019-13979

In Directus 7 API before version 2.2.1, a vulnerability exists that enables remote code execution through PHP file uploads.

What is CVE-2019-13979?

This CVE refers to a security flaw in Directus 7 API version 2.2.1 that permits the uploading of PHP files, leading to remote code execution via the uploads/_/originals directory.

The Impact of CVE-2019-13979

The vulnerability allows malicious actors to execute arbitrary code on the server, potentially compromising the system and data stored within.

Technical Details of CVE-2019-13979

Directus 7 API version 2.2.1 is susceptible to the following:

Vulnerability Description

Lack of restrictions on PHP file uploads
Remote code execution through uploads/_/originals directory

Affected Systems and Versions

Directus 7 API version 2.2.1

Exploitation Mechanism

Attackers can upload malicious PHP files to the uploads/_/originals directory, triggering remote code execution.

Mitigation and Prevention

To address CVE-2019-13979, consider the following steps:

Immediate Steps to Take

Upgrade Directus 7 API to a patched version that blocks PHP file uploads.
Monitor uploads/_/originals directory for suspicious files.

Long-Term Security Practices

Implement file type restrictions on uploads.
Regularly audit and review file upload mechanisms for security vulnerabilities.

Patching and Updates

Stay informed about security updates and patches released by Directus to address this vulnerability.