CVE-2024-36128
Directus is soft-locked by providing a string value to random string util
Impact
### Describe the Bug Providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the capability to generate a random session ID. ### To Reproduce 1. Test if the endpoint is working and accessible, `GET http://localhost:8055/utils/random/string` 2. Do a bad request `GET http://localhost:8055/utils/random/string?length=foo` 3. After this all calls to `GET http://localhost:8055/utils/random/string` will return an empty string instead of a random string 4. In this error situation you'll see authentication refreshes fail for the app and api. ### Impact This counts as an unauthenticated denial of service attack vector so this impacts all unpatched instances reachable over the internet.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | directus | <= 10.11.1 | 10.11.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Monospace | Directus | before 10.11.2 |