{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/directus--12.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Directus \u003c= 12.0.0"],"_cs_severities":["high"],"_cs_tags":["ssrf","directus","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Directus"],"content_html":"\u003cp\u003eDirectus, a headless CMS, is susceptible to an SSRF vulnerability (CVE-2026-35409) affecting versions prior to 11.16.0. This flaw allows attackers to bypass the intended IP deny-list by utilizing IPv4-Mapped IPv6 addresses. The vulnerability stems from the application's failure to properly normalize these addresses before validating them against the deny-list. This means an attacker can craft requests that appear to originate from a safe, external source, while the underlying system resolves the request to an internal resource. This vulnerability could be exploited by authenticated users or, in cases where public file import is enabled, by unauthenticated users. This issue was addressed in Directus version 11.16.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a Directus instance running a version prior to 11.16.0.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates to the Directus instance (or exploits public file import functionality if enabled).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious request to import a file, specifying a target IP address using an IPv4-Mapped IPv6 address (e.g., \u003ccode\u003e::ffff:127.0.0.1\u003c/code\u003e for localhost). This is done through the file import mechanism in Directus.\u003c/li\u003e\n\u003cli\u003eDirectus's IP deny-list validation logic fails to properly normalize the IPv6 address. The check does not recognize the IPv6 form as representing a blocked IPv4 address.\u003c/li\u003e\n\u003cli\u003eThe request bypasses the deny-list.\u003c/li\u003e\n\u003cli\u003eThe underlying HTTP client within Directus resolves the IPv6 address to its IPv4 equivalent.\u003c/li\u003e\n\u003cli\u003eThe request is sent to the internal service or cloud metadata endpoint specified in the IPv4-Mapped IPv6 address.\u003c/li\u003e\n\u003cli\u003eThe attacker receives the response from the internal service, potentially containing sensitive information like database credentials, cached data, internal API responses, or cloud instance metadata.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SSRF vulnerability (CVE-2026-35409) can lead to the exposure of sensitive internal resources. An attacker could potentially access databases, caches, internal APIs, or cloud instance metadata. The impact includes potential data breaches, privilege escalation within the internal network, and unauthorized access to cloud resources. Given the potential access to cloud instance metadata, attackers could gain access to AWS, GCP, or Azure environments. The number of vulnerable Directus instances is unknown, but any unpatched instance is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Directus to version 11.16.0 or later to remediate the vulnerability as described in the overview.\u003c/li\u003e\n\u003cli\u003eImplement a web application firewall (WAF) rule to block requests containing IPv4-Mapped IPv6 addresses in file import requests to mitigate potential exploitation, even if the Directus instance is patched. Focus on filtering \u003ccode\u003ecs-uri-query\u003c/code\u003e and \u003ccode\u003ecs-uri-path\u003c/code\u003e for patterns like \u0026quot;::ffff:\u0026quot;.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs (\u003ccode\u003ecategory: webserver\u003c/code\u003e, \u003ccode\u003eproduct: linux\u003c/code\u003e) for requests containing IPv4-Mapped IPv6 addresses targeting internal resources. Create a Sigma rule to detect such patterns in cs-uri-query or cs-uri-path fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:49:53Z","date_published":"2024-01-09T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-09-directus-ssrf/","summary":"Directus versions before 11.16.0 are vulnerable to Server-Side Request Forgery (SSRF) due to a bypass in IP address validation using IPv4-Mapped IPv6 addresses, allowing attackers to access internal services and sensitive cloud metadata.","title":"Directus SSRF Vulnerability via IPv4-Mapped IPv6 Addresses","url":"https://feed.craftedsignal.io/briefs/2024-01-09-directus-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Directus \u003c= 12.0.0","version":"https://jsonfeed.org/version/1.1"}