CVE-2024-28238: Session Token in URL in directus
Impact
When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
There's no workaround available.
References
Are there any links users can visit to find out more?
Other sources
Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. This issue has been addressed in version 10.10.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28238?
The severity of CVE-2024-28238 is potentially high due to security risks associated with including session tokens in URLs.
How do I fix CVE-2024-28238?
To fix CVE-2024-28238, ensure that JWT tokens are not passed through GET requests and instead use secure methods for session management.
What software versions are affected by CVE-2024-28238?
CVE-2024-28238 affects Directus versions up to but not including 10.10.0.
What are the risks associated with CVE-2024-28238?
The risks associated with CVE-2024-28238 include potential session hijacking if attackers gain access to logged URLs.
Is there a workaround for CVE-2024-28238?
A possible workaround for CVE-2024-28238 is to restrict access to logs containing sensitive information and avoid using JWT in URLs.