Executive Summary

This vulnerability affects Directus versions prior to 11.17.0, specifically its Single Sign-On (SSO) login pages. These pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header, which normally helps isolate the page from other origins.

Without the COOP header, a malicious cross-origin window that opens the Directus login page can still access and manipulate the window object of that page.

An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account, such as Google or Discord.

This vulnerability was fixed in Directus version 11.17.0.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access to your authentication provider accounts by attackers.

Specifically, an attacker can intercept and redirect the OAuth authorization flow, causing you to unknowingly grant access to your accounts (e.g., Google, Discord) to the attacker.

This can result in compromise of your personal or organizational accounts, potentially leading to data breaches or unauthorized actions performed under your identity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Directus to version 11.17.0 or later, where the issue is fixed by adding the Cross-Origin-Opener-Policy (COOP) HTTP response header to the Single Sign-On (SSO) login pages.

Useful 0 Not Useful 0