CVE-2024-28239 is a medium-severity (CVSS 5.4) Open Redirect vulnerability in directus. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for directus — see the affected versions and patch details below.
URL Redirection to Untrusted Site in OAuth2/OpenID in directus
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2024-28239.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
directusnpmDescription
Summary
The authentication API has a redirect parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL https://docs.directus.io/reference/authentication.html#login-using-sso-providers /auth/login/google?redirect for example.
Details
There's a redirect that is done after successful login via the Auth API GET request to directus/auth/login/google?redirect=http://malicious-fishing-site.com, which I think is here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L394. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password.
PoC
Turn on any auth provider in Directus instance. Form a link to directus-instance/auth/login/:provider_id?redirect=http://malicious-fishing-site.com, login and get taken to malicious-site. Tested on the ory OAuth2 integration.
Impact
Users who login via OAuth2 into Directus.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | directus | all versions | 10.10.0npm install directus@10.10.0 |
Affected Products
directusmonospaceResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for directus, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update directus to 10.10.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-28239 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is CVE-2024-28239 in your dependencies?
Find it across npm, including transitive dependencies.