CVE-2024-36128: Directus is soft-locked by providing a string value to random string util
Describe the Bug
Providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID.
To Reproduce
1. Test if the endpoint is working and accessible, GET http://localhost:8055/utils/random/string 2. Do a bad request GET http://localhost:8055/utils/random/string?length=foo 3. After this all calls to GET http://localhost:8055/utils/random/string will return an empty string instead of a random string 4. In this error situation you'll see authentication refreshes fail for the app and api.
Impact
This counts as an unauthenticated denial of service attack vector so this impacts all unpatched instances reachable over the internet.
Other sources
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. This vulnerability is fixed in 10.11.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36128?
CVE-2024-36128 is classified as a denial of service vulnerability due to memory issues when non-numeric length values are used in random string generation.
How do I fix CVE-2024-36128?
To fix CVE-2024-36128, upgrade Directus to version 10.11.2 or later to ensure proper handling of length values in random string generation.
Which versions of Directus are affected by CVE-2024-36128?
CVE-2024-36128 affects Directus versions up to and including 10.11.1.
What happens if I do not address CVE-2024-36128?
Failing to address CVE-2024-36128 can lead to service interruptions where logged-in sessions cannot be refreshed, causing users to experience downtime.
Is this vulnerability related to any specific platform?
CVE-2024-36128 affects the Directus application across all platforms that utilize the affected versions.