Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nMjdqLTc0ZnAteGZwcs04jw

Insecure default value for CORS configuration

Impact

The default value for the CORS_ENABLED and CORS_ORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.

Patches

The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0

Workarounds

Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.

For more information

If you have any questions or comments about this advisory:

• Open an issue in directus/directus
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-g27j-74fp-xfpr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nMjdqLTc0ZnAteGZwcs04jw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00196
EPSS Percentile: 0.57514

Identifiers: GHSA-g27j-74fp-xfpr, CVE-2022-26969
References:

• https://github.com/directus/directus/security/advisories/GHSA-g27j-74fp-xfpr
• https://github.com/directus/directus/pull/12022
• https://nvd.nist.gov/vuln/detail/CVE-2022-26969
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
• https://github.com/directus/directus/blob/8daed9c41baeaf1d08c1e292bf9f0dcef65e48fb/docs/configuration/config-options.md
• https://github.com/directus/directus/releases/tag/v9.7.0
• https://security.snyk.io/vuln/SNYK-JS-DIRECTUS-2441822
• https://github.com/advisories/GHSA-g27j-74fp-xfpr

Repository: https://github.com/directus/directus
Blast Radius: 20.2

Affected Packages