GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-R6WX-627V-GH2F

Vulnerability from github – Published: 2024-12-05 22:37 – Updated: 2025-11-19 17:50
VLAI
Summary
Directus has an HTML Injection in Comment
Details

Summary

The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.

Details

The Comment feature implements a character filter on the client-side, this can be bypassed by directly sending a request to the endpoint.

Example Request:

PATCH /activity/comment/3 HTTP/2
Host: directus.local

{
  "comment": "<h1>TEST <p style=\"color:red\">HTML INJECTION</p> <a href=\"//evil.com\">Test Link</a></h1>"
}

Example Response:

{
  "data": {
    "id": 3,
    "action": "comment",
    "user": "288fdccc-399a-40a1-ac63-811bf62e6a18",
    "timestamp": "2023-09-06T02:23:40.740Z",
    "ip": "10.42.0.1",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36",
    "collection": "directus_files",
    "item": "7247dda1-c386-4e7a-8121-7e9c1a42c15a",
    "comment": "<h1>TEST <p style=\"color:red\">HTML INJECTION</p> <a href=\"//evil.com\">Test Link</a></h1>",
    "origin": "https://directus.local",
    "revisions": []
  }
}

Example Result:

Screenshot 2023-09-06 094536

Impact

With the introduction of session cookies this issue has become exploitable as a malicious script is now able to do authenticated actions on the current users behalf.

Severity
5.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@directus/app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "13.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "directus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.10.0"
            },
            {
              "fixed": "10.13.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "directus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-rc.1"
            },
            {
              "fixed": "11.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-54128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-05T22:37:32Z",
    "nvd_published_at": "2024-12-05T17:15:15Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.\n\n### Details\nThe Comment feature implements a character filter on the client-side, this can be bypassed by directly sending a request to the endpoint.\n\nExample Request:\n\n```\nPATCH /activity/comment/3 HTTP/2\nHost: directus.local\n\n{\n  \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\"\n}\n```\n\nExample Response:\n\n```json\n{\n  \"data\": {\n    \"id\": 3,\n    \"action\": \"comment\",\n    \"user\": \"288fdccc-399a-40a1-ac63-811bf62e6a18\",\n    \"timestamp\": \"2023-09-06T02:23:40.740Z\",\n    \"ip\": \"10.42.0.1\",\n    \"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\n    \"collection\": \"directus_files\",\n    \"item\": \"7247dda1-c386-4e7a-8121-7e9c1a42c15a\",\n    \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\",\n    \"origin\": \"https://directus.local\",\n    \"revisions\": []\n  }\n}\n```\n\nExample Result:\n\n![Screenshot 2023-09-06 094536](https://user-images.githubusercontent.com/61263002/265876100-12e068fe-3d53-41b4-bfcb-458c2bc2a638.png)\n\n## Impact\n\nWith the introduction of session cookies this issue has become exploitable as a malicious script is now able to do authenticated actions on the current users behalf.",
  "id": "GHSA-r6wx-627v-gh2f",
  "modified": "2025-11-19T17:50:43Z",
  "published": "2024-12-05T22:37:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/directus/directus"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Directus has an HTML Injection in Comment"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.