Executive Summary

Directus versions prior to 11.16.1 have an open redirect vulnerability on the /admin/tfa-setup page via the redirect query parameter.

When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a specially crafted URL, they see the legitimate 2FA setup page.

After completing the 2FA setup, the application redirects the user to an attacker-controlled URL specified in the redirect parameter without validating it.

This means an attacker can trick administrators into visiting a trusted page and then redirect them to a malicious site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited in phishing attacks targeting Directus administrators.

Because the initial interaction happens on a trusted Directus domain, administrators may be more likely to trust the page and fall victim to the attack.

After setting up 2FA, the attacker can redirect the administrator to a malicious website, potentially leading to credential theft or further compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Directus to version 11.16.1 or later, where the open redirect issue via the redirect query parameter on the /admin/tfa-setup page has been fixed.

Useful 0 Not Useful 0