Directus vulnerable to SSRF Loopback IP filter bypass
Discription
Impact If you're relying on blocking access to localhost using the default 0.0.0.0 filter this can be bypassed using other registered loopback devices (like 127.0.0.2 – 127.127.127.127) Workaround You can block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any 127.X.X.X ip instead of just…Read More
References
Back to Main