Directus GraphQL Introspection Bypass Vulnerability Allowing Schema Exposure

A vulnerability in Directus versions prior to 11.16.1 allows for bypassing GraphQL introspection controls, exposing schema details through the 'server_specs_graphql' resolver on the '/graphql/system' endpoint. When 'GRAPHQL_INTROSPECTION=false' is set, Directus normally blocks standard introspection queries. However, the '/graphql/system' endpoint was not restricted, allowing unauthenticated users at the public permission level, and authenticated users at their permitted level, to access collection names, field names, types, and relationships.

Impact

This vulnerability could lead to unauthorized exposure of the GraphQL schema, including sensitive information about the database structure, to users who should not have access to it.

Remediation

Users can upgrade to Directus version 11.16.1 or later to address this vulnerability.