CVE-2022-23080 directus - SSRF which leads to internal port scan

What is CVE-2022-23080?

CVE-2022-23080 is a medium-severity server-side request forgery vulnerability in directus, published on 22 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.

Weakness: CWE-918

Which versions are affected by CVE-2022-23080?

2 open source packages ship an affected version, including directus. It affects 1 product.

Products include Rangerstudio Directus.

How do I fix CVE-2022-23080?

Upgrade directus to 9.7.0 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-23080 being exploited?

There is no known exploitation of CVE-2022-23080 in the wild and no public exploit code.

Other vulnerabilities in directus

• CVE-2018-10723 Hardcoded credentials in n/a Critical 9.8
• CVE-2022-24814 Cross-site Scripting in Directus High 8.8
• CVE-2021-29641 File upload in n/a High 8.8
• CVE-2021-26594 Privilege escalation in n/a High 8.8
• CVE-2023-27474 HTML Injection in Password Reset email to custom Reset URL in directus High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5h75-pvq4-82c9.