Vulnerability Description
Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g., when the product was obtained from hub.docker.com).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rangerstudio | Directus | >= 8.0.0, < 8.8.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/162118/Monospace-Directus-Headless-CMS-FileExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2021/Apr/14ExploitMailing ListThird Party Advisory
- https://hub.docker.com/layers/directus/directus/v8.8.2-apache/images/sha256-d989Third Party Advisory
- https://sec-consult.com/de/vulnerability-lab/advisory/arbitrary-file-upload-and-ExploitThird Party Advisory
- https://sec-consult.com/vulnerability-lab/advisory/arbitrary-file-upload-and-bypExploitThird Party Advisory
- http://packetstormsecurity.com/files/162118/Monospace-Directus-Headless-CMS-FileExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2021/Apr/14ExploitMailing ListThird Party Advisory
- https://hub.docker.com/layers/directus/directus/v8.8.2-apache/images/sha256-d989Third Party Advisory
- https://sec-consult.com/de/vulnerability-lab/advisory/arbitrary-file-upload-and-ExploitThird Party Advisory
- https://sec-consult.com/vulnerability-lab/advisory/arbitrary-file-upload-and-bypExploitThird Party Advisory
FAQ
What is CVE-2021-29641?
CVE-2021-29641 is a vulnerability with a CVSS score of 8.8 (HIGH). Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload...
How severe is CVE-2021-29641?
CVE-2021-29641 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-29641?
Check the references section above for vendor advisories and patch information. Affected products include: Rangerstudio Directus.