VYPR
High severityNVD Advisory· Published Mar 1, 2024· Updated Aug 28, 2024

Directus MySQL accent insensitive email matching

CVE-2024-27295

Description

Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insensitive and case-insensitive comparisons. This vulnerability is fixed in version 10.8.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
directusnpm
< 10.8.310.8.3

Affected products

1

Patches

1
a8ef790ea2d2

Merge pull request from GHSA-qw9g-7549-7wg5

https://github.com/directus/directusBrainslugDec 20, 2023via ghsa
1 file changed · +9 7
  • api/src/services/users.ts+9 7 modified
    @@ -139,9 +139,11 @@ export class UsersService extends ItemsService {
     	/**
     	 * Get basic information of user identified by email
     	 */
    -	private async getUserByEmail(email: string): Promise<{ id: string; role: string; status: string; password: string }> {
    +	private async getUserByEmail(
    +		email: string
    +	): Promise<{ id: string; role: string; status: string; password: string; email: string }> {
     		return await this.knex
    -			.select('id', 'role', 'status', 'password')
    +			.select('id', 'role', 'status', 'password', 'email')
     			.from('directus_users')
     			.whereRaw(`LOWER(??) = ?`, ['email', email.toLowerCase()])
     			.first();
    @@ -393,13 +395,13 @@ export class UsersService extends ItemsService {
     				const subjectLine = subject ?? "You've been invited";
     
     				await mailService.send({
    -					to: email,
    +					to: user.email,
     					subject: subjectLine,
     					template: {
     						name: 'user-invitation',
     						data: {
     							url: this.inviteUrl(email, url),
    -							email,
    +							email: user.email,
     						},
     					},
     				});
    @@ -451,7 +453,7 @@ export class UsersService extends ItemsService {
     			accountability: this.accountability,
     		});
     
    -		const payload = { email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
    +		const payload = { email: user.email, scope: 'password-reset', hash: getSimpleHash('' + user.password) };
     		const token = jwt.sign(payload, env['SECRET'] as string, { expiresIn: '1d', issuer: 'directus' });
     
     		const acceptURL = url
    @@ -461,13 +463,13 @@ export class UsersService extends ItemsService {
     		const subjectLine = subject ? subject : 'Password Reset Request';
     
     		await mailService.send({
    -			to: email,
    +			to: user.email,
     			subject: subjectLine,
     			template: {
     				name: 'password-reset',
     				data: {
     					url: acceptURL,
    -					email,
    +					email: user.email,
     				},
     			},
     		});
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.