GHSA-jvxj-w2qp-5vmx: 
JavaScript vulnerability analysis and mitigation

Summary

Directus did not forward the client's IP address, user agent or origin when accepting GraphQL WebSocket (subscription) connections. Policies that restrict access by IP (ip_access) treat a missing IP as "no restriction" when resolving admin and app access. A user with a policy granting admin_access only from a trusted network could therefore connect over the GraphQL WebSocket endpoint from any network and receive full admin access. In addition, the global access cache key ignored the client IP. An elevated result from the WebSocket path could be cached and returned for the same user's subsequent REST and GraphQL HTTP requests, extending the bypass beyond the WebSocket connection until the cache entry expired.

Impact

Deployments are affected if they use GraphQL WebSockets (enabled by default when WebSockets are enabled) and rely on ip_access to limit when a policy's admin_access or app_access applies. An authenticated user holding such a policy can bypass the network restriction and act as an administrator from outside the allowed range. Activity records for actions taken over the GraphQL WebSocket path were also written without IP, user agent or origin. Deployments that do not use ip_access on policies are not affected by the access bypass.

Patches

Fixed in 12.4.0. The GraphQL WebSocket handshake now carries the request's IP, user agent and origin into the connection's accountability (#27813, released in 12.1.0), and the global access cache is now keyed on the client IP (#28190, released in 12.4.0).

Workarounds

Disable GraphQL WebSockets with WEBSOCKETS_GRAPHQL_ENABLED=false, or avoid granting admin_access through policies whose only safeguard is ip_access.

Credits

Reported by pavelkohout396