CVE-2022-24814 : Exploit Details and Defense Strategies

Directus is a real-time API and App dashboard for managing SQL database content. An issue was found where unauthorized JavaScript can be executed, allowing the injection of malicious code. This vulnerability, tracked as CVE-2022-24814, affects versions prior to 9.7.0.

Understanding CVE-2022-24814

This section delves into the details of the CVE-2022-24814 vulnerability in Directus.

What is CVE-2022-24814?

CVE-2022-24814 is a Cross-site Scripting (XSS) vulnerability that existed in Directus versions before 9.7.0. It allowed for the execution of unauthorized JavaScript through the rich text html interface, potentially leading to the execution of arbitrary code.

The Impact of CVE-2022-24814

The impact of this vulnerability is rated as HIGH, with a CVSS base score of 8.8. It poses a risk to confidentiality, integrity, and availability, with no special privileges required for exploitation.

Technical Details of CVE-2022-24814

Let's explore the technical aspects of the CVE-2022-24814 vulnerability in Directus.

Vulnerability Description

Prior to version 9.7.0, Directus allowed the execution of unauthorized JavaScript by inserting an iframe into the rich text html interface, enabling the loading of malicious scripts.

Affected Systems and Versions

Directus versions earlier than 9.7.0 are affected by this vulnerability. Users are advised to update to version 9.7.0 or newer to mitigate the risk.

Exploitation Mechanism

The vulnerability allows attackers to embed an iframe pointing to a malicious HTML file that loads another JavaScript file, circumventing content security policies.

Mitigation and Prevention

To secure your Directus installation against CVE-2022-24814, it's crucial to take the following mitigation steps.

Immediate Steps to Take

Disable live embeds in the rich text html interface by adding

{ "media_live_embeds": false }

to the Options Overrides.

Long-Term Security Practices

Regularly update Directus to the latest version to patch known vulnerabilities and strengthen security posture.

Patching and Updates

Ensure that you update Directus to version 9.7.0 or newer to address the CVE-2022-24814 vulnerability.