CVE-2026-61835

Executive Summary

CVE-2026-61835 is a Server-Side Request Forgery (SSRF) vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The flaw resides in the file-import-from-URL feature, where the SSRF protection mechanism fails to block the literal IP address 0.0.0.0. On Linux and macOS systems, connecting to 0.0.0.0 resolves to localhost, allowing an authenticated attacker with file-upload rights to force the server to fetch internal services and exfiltrate the response as a downloadable file. The vulnerability is fixed in version 12.0.0.

Supply Chain & Package Security

Directus is distributed as an npm package (directus). Users should verify the integrity of the package via its checksum and ensure they are not using a compromised version from a malicious registry. The fix is included in the official npm release 12.0.0.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.7 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with file-upload rights)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (internal services can be read)
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the low complexity and the ability to exfiltrate sensitive internal data.

Deep Dive & Mechanics

The vulnerability exists in the file-import-from-URL functionality. The SSRF protection is implemented in api/src/request/is-denied-ip.ts. This module checks if a given IP address is a local or private address and denies the request if so. However, the check treats 0.0.0.0 as a keyword for local interfaces but does not block the literal string 0.0.0.0 itself. On Linux and macOS, connecting to 0.0.0.0 reaches the localhost, bypassing the intended protection.

The attack flow:

1. An authenticated user with file-upload rights sends a POST request to /files/import with a JSON body containing {"url": "http://0.0.0.0:8080/internal-endpoint"}.
2. The server's SSRF protection checks the IP but fails to block 0.0.0.0.
3. The server makes an HTTP request to 0.0.0.0:8080, which resolves to localhost.
4. The response from the internal service is saved as a file in Directus.
5. The attacker can then download that file, exfiltrating the internal data.

Vulnerable vs. Patched Code

Vulnerable Code (is-denied-ip.ts):

// Vulnerable: Only checks if the IP is in a list of denied IPs, but 0.0.0.0 is not in the list.
export function isDeniedIP(ip: string): boolean {
  const deniedIPs = ['127.0.0.1', '::1', 'localhost'];
  return deniedIPs.includes(ip);
}

Patched Code (is-denied-ip.ts):

// Patched: Explicitly blocks 0.0.0.0 and uses proper IP normalization.
import { isIP } from 'net';
export function isDeniedIP(ip: string): boolean {
  const deniedIPs = ['127.0.0.1', '::1', 'localhost', '0.0.0.0'];
  if (isIP(ip) && deniedIPs.includes(ip)) {
    return true;
  }
  // Additional check for IP ranges
  return false;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Directus instance (version < 12.0.0) with an authenticated user having file-upload rights.
• An internal service running on localhost (e.g., a metadata endpoint on port 8080).

Exploitation Steps:

1. Authenticate to Directus and obtain a session token.
2. Send a POST request to /files/import with the following payload:

   {
     "url": "http://0.0.0.0:8080/internal-endpoint"
   }
   

3. The server will fetch the internal endpoint and save the response as a file.
4. Retrieve the file ID from the response and download it via /files/{file_id}/download.

Example cURL command:

curl -X POST 'https://target.directus.app/files/import' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"url":"http://0.0.0.0:8080/internal-endpoint"}'

Blue Team

Detection:

• Monitor for requests to /files/import with URLs containing 0.0.0.0 or other loopback addresses.
• Alert on any file import from a URL that resolves to a private IP range.

Hunting:

• Search logs for POST /files/import with url parameter containing 0.0.0.0.
• Check for files created by the import feature that have unusual content (e.g., internal service responses).

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from the Directus server to 0.0.0.0 on any port.
• File: Files in Directus with names or content matching internal service responses (e.g., /internal-endpoint).
• Logs: Log entries showing POST /files/import with url containing 0.0.0.0.

Detection Engineering

YARA Rule

rule CVE_2026_61835_SSRF_Directus {
  meta:
    description = "Detects SSRF exploitation attempts against Directus via 0.0.0.0"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-61835"
  strings:
    $ssrf_payload = "0.0.0.0" ascii wide nocase
    $import_endpoint = "/files/import" ascii wide nocase
  condition:
    $ssrf_payload and $import_endpoint
}

Sigma Rule

title: Directus SSRF via 0.0.0.0
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2026-61835 by using 0.0.0.0 in file import URLs
author: Valters IT
logsource:
  category: webserver
  product: directus
detection:
  selection:
    http.method: 'POST'
    http.url: '/files/import'
    http.body|contains: '0.0.0.0'
  condition: selection
falsepositives:
  - Legitimate use of 0.0.0.0 in internal networks (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-61835 Directus SSRF via 0.0.0.0"; flow:to_server; content:"POST"; http_method; content:"/files/import"; http_uri; content:"0.0.0.0"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Directus to version 12.0.0 or later.
• If upgrade is not possible, apply a WAF rule to block requests to /files/import containing 0.0.0.0 in the body.

Long-term:

• Implement network segmentation to limit outbound traffic from the Directus server.
• Use a proxy that enforces strict allowlists for outbound connections.
• Regularly audit file import logs for suspicious URLs.

Workaround:

• Disable the file-import-from-URL feature if not needed by modifying the Directus configuration.

Valters IT