CVE-2024-54128

Executive Summary

CVE-2024-54128 is a client-side HTML Injection vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The Comment feature implements a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulnerability is fixed in versions 10.13.4 and 11.2.0.

Supply Chain & Package Security

Directus is distributed as an npm package (directus). Users should update to the latest patched version via npm. The vulnerability is not in a dependency but in the core application logic.

CVSS Breakdown & Threat Level

• CVSS Score: 5.7 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is medium due to the requirement for user interaction and the limited impact. However, the ease of exploitation and the potential for phishing or defacement attacks should not be underestimated.

Deep Dive & Mechanics

The vulnerability resides in the Comment feature of Directus. The application attempts to sanitize user input by filtering out HTML tags on the client-side using JavaScript. This filter can be easily bypassed by:

1. Disabling JavaScript: An attacker can disable JavaScript in their browser, causing the client-side filter to not execute.
2. Intercepting and Modifying Requests: Using a proxy tool (e.g., Burp Suite, OWASP ZAP), an attacker can intercept the HTTP request containing the comment and modify the payload to include malicious HTML tags.
3. Crafting a Direct API Request: The attacker can send a crafted HTTP request directly to the API endpoint responsible for creating comments, bypassing the web interface entirely.

Once the malicious HTML is stored in the database, it will be rendered in the browsers of other users viewing the comment, leading to HTML Injection. This can be used for:

• Phishing: Displaying fake login forms to steal credentials.
• Defacement: Altering the appearance of the application.
• Content Spoofing: Injecting misleading information.

Vulnerable vs. Patched Code

Vulnerable Code (Client-Side Filter - JavaScript):

// Client-side filter (vulnerable)
function sanitizeComment(input) {
    // This filter is easily bypassed
    return input.replace(/<[^>]*>/g, '');
}

Patched Code (Server-Side Validation - Node.js):

// Server-side validation (patched)
const sanitizeHtml = require('sanitize-html');

function createComment(req, res) {
    const comment = req.body.comment;
    // Server-side sanitization
    const cleanComment = sanitizeHtml(comment, {
        allowedTags: [],
        allowedAttributes: {}
    });
    // Save cleanComment to database
}

Exploitation & Lab Setup

Red Team

Objective: Exploit the HTML Injection vulnerability to execute a proof-of-concept attack.

Lab Setup:

1. Install a vulnerable version of Directus (e.g., 10.13.3) using Docker:

   docker run -p 8055:8055 directus/directus:10.13.3
   

2. Access the Directus instance at http://localhost:8055.
3. Log in as a user with permission to create comments.

Exploitation Steps:

1. Intercept the request to create a comment using a proxy like Burp Suite.
2. Modify the comment parameter to include a malicious HTML payload:

   <script>alert('XSS')</script>
   

3. Forward the request.
4. When another user views the comment, the JavaScript will execute.

Alternative Method (Direct API Request):

curl -X POST http://localhost:8055/items/comments \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your_token>" \
  -d '{"comment": "<img src=x onerror=alert(1)>"}'

Blue Team

Objective: Detect and prevent exploitation attempts.

Detection:

1. Monitor for requests to the comments API endpoint (/items/comments) with suspicious payloads.
2. Look for patterns like <script, <img, <svg, or other HTML tags in the request body.
3. Use Web Application Firewall (WAF) rules to block requests containing HTML tags in the comment field.

Prevention:

1. Immediately update Directus to version 10.13.4 or 11.2.0.
2. Implement server-side input validation and sanitization for all user inputs.
3. Use Content Security Policy (CSP) headers to mitigate the impact of HTML Injection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /items/comments containing HTML tags.
  • Requests with Content-Type: application/json and a comment field containing <script>, <img, or similar tags.
• Host IOCs:
  • Log entries showing failed validation attempts for the comment field.
  • Presence of unexpected HTML content in the database's comments table.
• File IOCs:
  • Modified JavaScript files that bypass client-side filters (less likely).

Detection Engineering

YARA Rule

rule Detect_Directus_HTML_Injection_Attempt {
    meta:
        description = "Detects attempts to exploit CVE-2024-54128 in Directus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-54128"
    strings:
        $html_tag = /<[^>]*>/
        $comment_endpoint = "/items/comments"
    condition:
        $comment_endpoint and $html_tag
}

Sigma Rule

title: Directus HTML Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to Directus comment endpoint with HTML tags
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54128
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/items/comments'
        cs-uri-query|contains: 
            - '<script'
            - '<img'
            - '<svg'
            - '<iframe'
    condition: selection
falsepositives:
    - Legitimate use of HTML in comments (if allowed by admin)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54128 Directus HTML Injection Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/items/comments"; http.request_body; content:"<"; pcre:"/<[^>]*>/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update Directus to version 10.13.4 or 11.2.0.
2. Compensating Controls:
   • Implement a Web Application Firewall (WAF) with rules to block HTML tags in comment fields.
   • Enforce strict Content Security Policy (CSP) headers.
   • Enable server-side input validation for all user inputs.
3. Long-Term Measures:
   • Conduct regular security audits of the application.
   • Implement a bug bounty program.
   • Follow secure coding practices, including server-side validation.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert