| Package | Affected versions | Patched versions |
|---|---|---|
| directus | < 10.11.2 | 10.11.2 |
| directus | < 10.11.2 | 10.11.2 |
Providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID.
GET http://localhost:8055/utils/random/stringGET http://localhost:8055/utils/random/string?length=fooGET http://localhost:8055/utils/random/string will return an empty string instead of a random stringThis counts as an unauthenticated denial of service attack vector so this impacts all unpatched instances reachable over the internet.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free