Summary
The authentication API has a redirect
parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL https://docs.directus.io/reference/authentication.html#login-using-sso-providers /auth/login/google?redirect for example.
Details
There's a redirect that is done after successful login via the Auth API GET request to directus/auth/login/google?redirect=http://malicious-fishing-site.com
, which I think is here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L394. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password.
PoC
Turn on any auth provider in Directus instance. Form a link to directus-instance/auth/login/:provider_id?redirect=http://malicious-fishing-site.com
, login and get taken to malicious-site. Tested on the ory
OAuth2 integration.
Impact
Users who login via OAuth2 into Directus.
Summary
The authentication API has a
redirect
parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL https://docs.directus.io/reference/authentication.html#login-using-sso-providers /auth/login/google?redirect for example.Details
There's a redirect that is done after successful login via the Auth API GET request to
directus/auth/login/google?redirect=http://malicious-fishing-site.com
, which I think is here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L394. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password.PoC
Turn on any auth provider in Directus instance. Form a link to
directus-instance/auth/login/:provider_id?redirect=http://malicious-fishing-site.com
, login and get taken to malicious-site. Tested on theory
OAuth2 integration.Impact
Users who login via OAuth2 into Directus.