{"id":"GHSA-j8xj-7jff-46mx","summary":"Directus's S3 assets become unavailable after a burst of malformed transformations","details":"### Summary\nWhen making many malformed transformation requests at once, at some point, all assets are being served as 403.\n\n### Details\nWhen I was investigating this issue, I have found that after a burst of malformed asset transformation requests, the amount of `sockets` held on [Agent on NodeHttpHandler](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/node-http-handler/src/node-http-handler.ts#L189) was always equal to [`STORAGE_CLOUD_MAX_SOCKETS`](https://github.com/directus/directus/blob/main/packages/storage-driver-s3/src/index.ts#L89) making it impossible to have new connections causing assets to be inaccessible.\n\nAfter looking into this [issue on AWS SDK](https://github.com/aws/aws-sdk-js-v3/issues/6691) I found that if the [stream is requested](https://github.com/directus/directus/blob/main/api/src/services/assets.ts#L213), it needs to be consumed otherwise will hang forever. And as can be [seen here](https://github.com/directus/directus/blob/main/api/src/services/assets.ts#L184) the stream is not consumed, because `sharp` will throw an error on the invalid arguments. For example `?height=xyz`\n\nThe [timeouts set here](https://github.com/directus/directus/blob/main/packages/storage-driver-s3/src/index.ts#L87-L88)  had no noticeable effect on tests made.\n\n### PoC\nThis can be easily reproduced with the following steps:\n- setup AWS S3 storage\n- set STORAGE_CLOUD_MAX_SOCKETS: \"50\" (this value is lower than default for easier reproduction)\n- upload a file to your project\n- run this file (Replace the the file ID with the one you just uploaded):\n```ts\nimport axios from \"axios\";\n\nasync function start() {\n  Array.from({ length: 400 }, (_, i) =\u003e {\n    axios\n      .get(\n        \"http://localhost:8055/assets/e536aa35-3a81-4fa9-b856-3780584d38d8?width=100&height=XYZ\"\n      )\n      .then(() =\u003e console.log(\"✅\"))\n      .catch((e) =\u003e\n        console.log(\"⛔\", e.response?.status || e.code || e.message)\n      );\n  });\n}\n\nstart();\n```\n\nHere's an example:\n\n\n\nhttps://github.com/user-attachments/assets/7f5a6f51-1c51-4d4d-aa4f-c4953e91714c\n\n\n\n\n\n### Impact\nThis causes denial of assets for all policies of Directus, including Admin and Public.","aliases":["CVE-2025-30225"],"modified":"2025-03-27T03:42:48Z","published":"2025-03-26T17:19:28Z","database_specific":{"cwe_ids":["CWE-770"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-03-26T17:19:28Z","nvd_published_at":"2025-03-26T17:15:26Z"},"references":[{"type":"WEB","url":"https://github.com/directus/directus/security/advisories/GHSA-j8xj-7jff-46mx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30225"},{"type":"PACKAGE","url":"https://github.com/directus/directus"}],"affected":[{"package":{"name":"@directus/storage-driver-s3","ecosystem":"npm","purl":"pkg:npm/%40directus/storage-driver-s3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.22.0"},{"fixed":"12.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-j8xj-7jff-46mx/GHSA-j8xj-7jff-46mx.json"}},{"package":{"name":"directus","ecosystem":"npm","purl":"pkg:npm/directus"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.22.0"},{"fixed":"11.5.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-j8xj-7jff-46mx/GHSA-j8xj-7jff-46mx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}