A critical SSRF vulnerability in Directus versions prior to 11.16.0 allows authenticated attackers to bypass IP restrictions and potentially access internal network resources.

The application utilizes an insufficient IP address validation mechanism that fails to properly block local or private network requests when IPv4-Mapped IPv6 addresses are used. This flaw permits an authenticated user to perform SSRF attacks by bypassing intended network access controls.

Successful exploitation of this SSRF vulnerability could allow an attacker to interact with internal services that are not exposed to the public internet, leading to unauthorized data access or internal reconnaissance. Given the CVSS score of 7.7, this represents a high-severity risk that could undermine the integrity of the internal network architecture. Organizations should treat this as a priority to prevent potential lateral movement or sensitive information disclosure.

Immediate Action: Update the Directus installation to version 11.16.0 or later to implement the corrected IP address validation logic.

Proactive Monitoring: Review application logs for unusual outbound request patterns or attempts to access internal IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16).

Compensating Controls: Ensure the application is running in a network-isolated environment with egress filtering applied to prevent the server from initiating unauthorized connections to sensitive internal endpoints.

Public Exploit Available: No

The vulnerability presents a significant risk to internal network security by enabling attackers to bypass standard access controls. IT administrators must prioritize the update to version 11.16.0 to eliminate the SSRF vector. Failure to patch may expose backend infrastructure to unauthorized requests, and immediate remediation is strongly advised to maintain the security posture of the application environment.