GHSA-95f8-mvw7-gpj9: 
JavaScript vulnerability analysis and mitigation

Summary

A user who is allowed to set storage and filename_disk when creating files could upload into the directory Directus loads extensions from, whenever that directory was reachable through a configured storage location. Directus executes extension code inside the server process, so this leads to server-side code execution. With EXTENSIONS_AUTO_RELOAD enabled, overwriting the entrypoint of an already loaded extension runs the uploaded code immediately. Otherwise it runs on the next restart or extension reload.

Details

The file upload path wrote to whichever storage location and filename_disk the payload specified, as long as the path stayed inside the storage root. It did not check whether that path was also part of the extensions namespace. Two configurations expose this:

• A local storage location whose root contains EXTENSIONS_PATH, for example STORAGE_LOCAL_ROOT=/directus/uploads with EXTENSIONS_PATH=/directus/uploads/extensions. An upload with filename_disk=extensions/<name>/index.mjs overwrites that extension's entrypoint on disk.
• EXTENSIONS_LOCATION pointing at a storage location that is also available for uploads. An upload into EXTENSIONS_PATH on that location places a new extension that is synced and loaded on the next start. An earlier guard added for this class compared the storage-root-prefixed path against the location-relative EXTENSIONS_PATH for local drivers, so it did not trigger for the second configuration when the extensions location used the local driver. The default configuration is not affected. storage and filename_disk are not writable by non-admin roles unless an administrator grants them explicitly, the default local layout keeps ./uploads and ./extensions as sibling directories, and EXTENSIONS_LOCATION is unset by default.

Impact

An authenticated user whose role has create (or update) permission on directus_files with write access to the storage and filename_disk fields can execute arbitrary JavaScript in the Directus process, on instances where an upload-writable storage location overlaps the extensions directory. That gives access to the process environment, any files and internal services the Directus process can reach, and full control over the application.

Workarounds

a. Do not grant non-admin roles write access to the storage and filename_disk fields of directus_files. b. Keep EXTENSIONS_PATH outside every storage location root, and do not use the storage location set as EXTENSIONS_LOCATION for regular uploads. c. Do not enable EXTENSIONS_AUTO_RELOAD in production.

Credits

Reported by kamil-sawicki