CVE-2024-39896: Directus allows SSO User Enumeration
Impact When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider.
Reproduction
1. Create a user using a SSO provider test@directus.io. 2. Try to log-in using the regular login form (or the API) 3. When using a valid email address
| APP | API | | --- | --- | | !image | !image |
4. When using an invalid email address
| APP | API | | --- | --- | | !image | !image |
5. Using this differing error it is possible to determine whether a specific email address is present in the Directus instance as an SSO user.
Workarounds When only using SSO for authentication then you can work around this issue by disabling local login using the following environment variable AUTHDISABLEDEFAULT="true"
References Implemented as feature in https://github.com/directus/directus/pull/13184 https://owasp.org/www-project-web-security-testing-guide/v42/4-WebApplicationSecurityTesting/03-IdentityManagementTesting/04-TestingforAccountEnumerationandGuessableUserAccount
Other sources
Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39896?
The severity of CVE-2024-39896 is classified as a medium risk due to potential user enumeration via SSO methods.
How do I fix CVE-2024-39896?
To mitigate CVE-2024-39896, upgrade to Directus version 10.13.0 or later.
What types of systems are affected by CVE-2024-39896?
CVE-2024-39896 affects Directus versions between 9.11.0 and 10.12.9 as well as earlier versions.
What specific vulnerability does CVE-2024-39896 address?
CVE-2024-39896 addresses the issue of user enumeration when using SSO providers combined with local authentication.
Does CVE-2024-39896 impact all SSO providers?
CVE-2024-39896 specifically impacts systems using known SSO providers integrated with Directus.