CVE-2024-39699: 
JavaScript vulnerability analysis and mitigation

Directus, a real-time API and App dashboard for managing SQL database content, was found to contain a Server-Side Request Forgery (SSRF) vulnerability (CVE-2024-39699). The vulnerability was discovered in the file import functionality, where despite previous security measures implemented to resolve DNS names and check for internal IP addresses, attackers could bypass these controls using redirects. The vulnerability affects versions prior to 10.9.3 (GitHub Advisory).

The vulnerability exists in the file import functionality where Directus allows redirects when importing files from URLs but fails to validate the final destination URL after redirection. While previous security measures were implemented to check for internal IP addresses, this bypass method enables attackers to execute requests to internal IP addresses (e.g., 127.0.0.1). Although the vulnerability results in a blind SSRF due to response interception techniques implemented by Directus, it remains exploitable in real-world scenarios, particularly against internal network services vulnerable to GET requests (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 5.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (NVD).

Despite being a blind SSRF vulnerability where response content is not directly visible to the attacker, the impact remains significant as it allows attackers to initiate HTTP GET requests to internal network resources. This could be particularly dangerous if vulnerable software exists within the internal network that can be exploited through GET requests (GitHub Advisory).

The vulnerability has been fixed in Directus version 10.9.3. The recommended mitigation is to upgrade to this version or newer. Two potential fix approaches were identified: either disallowing redirects for import requests entirely, or implementing validation of the Location header in import request responses to prevent redirects to internal IP addresses (GitHub Advisory).