Executive brief
Directus is a headless CMS platform used for managing databases and content. Users with read permissions to the password field can extract password hashes by exploiting the export functionality combined with string filters, enabling an attacker to enumerate and potentially crack user credentials.
Technical details
The vulnerability is an information disclosure (CWE-200) in Directus's export and filtering mechanism. Users with read access to the password field in the directus_users table can leverage the _starts_with and other string operators to brute-force extract argon2 password hashes through repeated export queries. The attack requires high-level privileges (read access to password field) and network access, but no user interaction. Exploitation allows an attacker to enumerate and obtain password hashes for offline cracking. The issue was patched in version 9.16.0 by blocking string-based filters against hashed/concealed fields.
Affected products
- Directus directus before 9.16.0
Timeline
- 2023-03-07: disclosed: NVD publication date
- 2023-03-08: disclosed: GitHub Security Advisory published
- 2023: patched: Fixed in version 9.16.0