Listen to this Post
The open redirect vulnerability in Directus arises from insufficient validation within the SAML 2.0 authentication flow. Specifically, the `RelayState` parameter, which is intended to preserve the user’s original request destination, is not sanitized or validated against a strict allowlist when processed by the SAML callback endpoint (/auth/login/saml/callback). During login initiation, Directus correctly validates the `redirect` parameter, but this security check is entirely bypassed in the callback logic that handles the SAML response from the Identity Provider (IdP). An attacker can craft a malicious SAML authentication request by setting the `RelayState` parameter to a fully controlled external URL (e.g., `https://evil.com`). This malicious request is sent to the IdP, which then forwards the user and the tampered `RelayState` back to the Directus callback endpoint upon authentication. The vulnerable callback code, in both success and error paths, blindly reads this `RelayState` value and issues an HTTP 302 redirect to it, without verifying if the domain is permitted. This allows an unauthenticated attacker to trick users into visiting trusted Directus login pages that subsequently redirect to phishing sites. The exploit can be delivered via a simple crafted link, and successful redirection may leak OAuth authorization codes or session tokens appended to the URL by the application’s normal flow, amplifying the impact.
Platform: Directus
Version: Unspecified versions
Vulnerability: SAML Open Redirect
Severity: Critical
date: Not disclosed
Prediction: Patch date unknown
What Undercode Say:
Analytics
curl -I "https://directus.example.com/auth/login/saml?RelayState=https://evil.com"
grep -r "RelayState" /app/auth/saml/
// Example vulnerable code snippet const relayState = req.query.RelayState; return res.redirect(relayState);
how Exploit:
Craft malicious SAML request with poisoned RelayState parameter pointing to attacker domain. Lure victim to initiate login via this request. Directus callback will redirect victim to attacker site post-authentication, potentially capturing tokens or credentials.
Protection from this CVE
Implement strict allowlist validation for all redirect URLs, including RelayState, in the SAML callback endpoint. Apply same validation logic as login initiation. Sanitize and prefix-check all redirect targets.
Impact:
Phishing attacks, credential theft, OAuth token capture, trust erosion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
