CVE-2021-26593 : Security Advisory and Response

Directus 8.x through 8.8.1 is vulnerable to an information disclosure issue that allows attackers to view all users in the CMS, including sensitive details like email addresses, names, and 2FA secrets through the API. This vulnerability impacts unsupported products.

Understanding CVE-2021-26593

This CVE refers to an information disclosure vulnerability in Directus 8.x through 8.8.1 that enables unauthorized access to sensitive user information.

What is CVE-2021-26593?

This CVE allows attackers to retrieve extensive user details, including email addresses, names, and 2FA secrets via the /users/{id} API endpoint in Directus 8.x through 8.8.1.

The Impact of CVE-2021-26593

The vulnerability poses a significant risk as it exposes confidential user data, such as email addresses and 2FA secrets, to unauthorized parties. It particularly affects products that are no longer supported by the maintainer.

Technical Details of CVE-2021-26593

Directus 8.x through 8.8.1 suffers from an information disclosure flaw that allows attackers to access extensive user data through the /users/{id} API endpoint.

Vulnerability Description

The vulnerability enables attackers to extract user information, including email addresses, names, and 2FA secrets, compromising user privacy and security.

Affected Systems and Versions

Directus versions 8.x through 8.8.1 are impacted by this information disclosure vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by sending malicious requests to the /users/{id} API endpoint, leading to the unauthorized disclosure of sensitive user data.

Mitigation and Prevention

Addressing CVE-2021-26593 requires immediate action to secure user data and prevent unauthorized access.

Immediate Steps to Take

Users of affected Directus versions should update to the latest supported release and configure systems to minimize exposure of sensitive information.

Long-Term Security Practices

Implement security best practices, such as regular security audits, user access controls, and data encryption, to enhance overall system security.

Patching and Updates

Directus users should apply patches provided by the maintainer promptly to fix the information disclosure vulnerability and protect user data from unauthorized access.