GHSA-32cw-mf7w-gpqr: 
JavaScript vulnerability analysis and mitigation

Summary

An authenticated user who can import into any collection can pollute Object.prototype for the whole Directus process with a single CSV import. The polluted key is then folded into the SQL of every subsequent object-form query, so logins and most reads fail with a database error. The instance stays unusable until it is restarted. This is a bypass of the fix for GHSA-gwvv-rr68-cmv6.

Details

The fix for GHSA-gwvv-rr68-cmv6 introduced a setDeep helper that builds nested paths on null-prototype objects. It was meant to reuse an existing path segment only when that segment is an own object, but it checked only typeof node[key] === 'object'. That plain read follows the prototype chain, so an inherited __proto__ segment resolves to Object.prototype whenever the current node is an ordinary object. The CSV importer builds each row by calling setDeep once per header, and it runs each cell through parseJSON first. A cell containing {} therefore places an ordinary, prototype-bearing object into the row. A later header that walks through it reaches the shared prototype:

a,a.__proto__.polluted
{},"yes"

The first header sets row.a = {}. The second header walks row, then a, then a.__proto__ (Object.prototype), and sets Object.prototype.polluted = 'yes'. knex builds object-form .where() and .update() clauses by enumerating inherited enumerable properties, so after the import every such query gains a phantom polluted column. For example, the last_access update that runs on every login becomes update directus_users set last_access = ?, polluted = 'yes' where id = ? and polluted = 'yes', which fails with an unknown-column error. Because the injected key also lands in the WHERE clause, affected writes fail rather than modify extra columns.

Impact

• Persistent denial of service. After one import request, every login and most reads fail until the process is restarted. The process itself keeps running, so health checks and supervisors do not recover it automatically.
• Low privilege. Only an authenticated account with create and update permission on a single collection is required. No admin access or non-default configuration is needed.

Credits

Reported by Al Baradi Joy (@a1barad1)