CVE-2024-46990: SSRF Loopback IP filter bypass in directus
Impact If you're relying on blocking access to localhost using the default 0.0.0.0 filter this can be bypassed using other registered loopback devices (like 127.0.0.2 - 127.127.127.127)
Workaround You can block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any 127.X.X.X ip instead of just 127.0.0.1.
Other sources
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default 0.0.0.0 filter a user may bypass this block by using other registered loopback devices (like 127.0.0.2 - 127.127.127.127). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any 127.X.X.X ip instead of just 127.0.0.1.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46990?
CVE-2024-46990 has a high severity due to its potential to allow unauthorized access through loopback device bypass.
How do I fix CVE-2024-46990?
To fix CVE-2024-46990, update to @directus/api version 22.1.1 or 21.0.0, or for directus, update to version 11.1.0 or 10.13.3.
What systems are affected by CVE-2024-46990?
CVE-2024-46990 affects @directus/api versions between 22.0.0 and 22.1.1, and all versions up to 21.0.0, as well as directus versions 11.0.0 to 11.1.0 and all versions up to 10.13.3.
Can CVE-2024-46990 be exploited remotely?
Yes, CVE-2024-46990 can be exploited remotely if access restrictions are improperly configured.
What are the potential impacts of CVE-2024-46990?
The potential impacts of CVE-2024-46990 include unauthorized access to application data, which could lead to data breaches.