Executive brief
Directus, a popular headless CMS platform, fails to properly redact authentication tokens from its log files. An attacker with access to logs—such as through shared cloud infrastructure or log aggregation services—can extract refresh tokens and use them to impersonate users and perform unauthorized actions in the application, bypassing audit trails and accountability controls.
Technical details
Directus v9.23.1 fails to redact the directus_refresh_token cookie from structured log output, exposing it in plain text when logs are generated with LOG_STYLE="raw". The vulnerability exists in the logger configuration (api/src/logger.ts) which does not properly mask this sensitive authentication token. An attacker with read access to application logs can extract the refresh token and exchange it for an access token via the /auth/refresh endpoint, enabling account takeover and impersonation without the legitimate user's knowledge. The vulnerability requires local or privileged access to log files and user interaction (the victim must log in to generate a token in logs). The fix was released in version 9.23.3.
Affected products
- Directus Directus before 9.23.3
Timeline
- 2023-03-23: disclosed
- 2023-03-23: patched: Version 9.23.3 released