CVE-2024-27296 (published 2024-03-01T16:15Z)

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. The problem has been resolved in versions 10.8.3 and newer.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/directus/directus
commit_details: repo_url: https://github.com/directus/directus
author: Brainslug
author_date: 2023-11-30 15:25:20+01:00
msg: replaced hardcoded versions in the app
repository: repo_url: https://github.com/directus/directus
repo_name: directus/directus
description: The Modern Data Stack 🐰 — Directus is an instant REST+GraphQL API and intuitive no-code data collaboration app for any SQL database.
repo_language: TypeScript
owner: directus
file_changes: filename: env.d.ts
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,2 @@
 /// <reference types="vite/client" />
 /// <reference types="@histoire/plugin-vue/components" />
-
-declare const __DIRECTUS_VERSION__: string;

programming_language: JavaScript
filename: main.ts
change_type: ModificationType.MODIFY
diff: @@ -17,19 +17,13 @@ import { registerViews } from './views/register';
 init();
 
 async function init() {
-	const version = __DIRECTUS_VERSION__;
-
 	console.log(DIRECTUS_LOGO);
 
 	console.info(
 		`Hey! Interested in helping build this open-source data management platform?\nIf so, join our growing team of contributors at: https://directus.chat`,
 	);
 
-	if (import.meta.env.DEV) {
-		console.info(`%c🐰 Starting Directus v${version}...`, 'color:Green');
-	} else {
-		console.info(`%c🐰 Starting Directus...`, 'color:Green');
-	}
+	console.info(`%c🐰 Starting Directus...`, 'color:Green');
 
 	console.time('🕓 Application Loaded');
 

programming_language: TypeScript
filename: navigation.vue
change_type: ModificationType.MODIFY
diff: @@ -1,10 +1,10 @@
 <script setup lang="ts">
+import { useServerStore } from '@/stores/server';
 import { computed } from 'vue';
 import { useI18n } from 'vue-i18n';
 
-const version = __DIRECTUS_VERSION__;
-
 const { t } = useI18n();
+const { info } = useServerStore();
 
 const dataItems = [
 	{
@@ -103,7 +103,7 @@ const externalItems = computed(() => {
 		<v-list-item href="https://github.com/directus/directus/releases" class="version">
 			<v-list-item-icon><v-icon name="directus" /></v-list-item-icon>
 			<v-list-item-content>
-				<v-text-overflow class="version" :text="`Directus ${version}`" />
+				<v-text-overflow class="version" :text="`Directus ${info.version}`" />
 			</v-list-item-content>
 		</v-list-item>
 	</v-list>

programming_language: TypeScript
filename: server.ts
change_type: ModificationType.MODIFY
diff: @@ -43,6 +43,7 @@ export type Info = {
 		default: number;
 		max: number;
 	};
+	version?: string;
 };
 
 export type Auth = {
@@ -83,6 +84,7 @@ export const useServerStore = defineStore('serverStore', () => {
 
 		info.project = serverInfoResponse.data.data?.project;
 		info.queryLimit = serverInfoResponse.data.data?.queryLimit;
+		info.version = serverInfoResponse.data.data?.version;
 
 		auth.providers = authResponse.data.data;
 		auth.disableDefault = authResponse.data.disableDefault;

programming_language: TypeScript
filename: vite.config.js
change_type: ModificationType.MODIFY
diff: @@ -18,16 +18,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { searchForWorkspaceRoot } from 'vite';
 import { defineConfig } from 'vitest/config';
-import { version } from '../directus/package.json';
 
 const API_PATH = path.join('..', 'api');
 const EXTENSIONS_PATH = path.join(API_PATH, 'extensions');
 
 // https://vitejs.dev/config/
 export default defineConfig({
-	define: {
-		__DIRECTUS_VERSION__: JSON.stringify(version),
-	},
 	plugins: [
 		directusExtensions(),
 		vue(),

programming_language: JavaScript