CVE-2024-54151: Directus allows unauthenticated access to WebSocket events and operations

December 9, 2024

When setting WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH to “public”, an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges.

References

github.com/advisories/GHSA-849r-qrwj-8rv4
github.com/directus/directus
github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21
github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4
nvd.nist.gov/vuln/detail/CVE-2024-54151

Code Behaviors & Features

Detect and mitigate CVE-2024-54151 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →