Executive brief
Directus is a flexible API-based CMS and database management platform. A vulnerability in the API's alias parameter allows authenticated users with read permissions to bypass redaction controls and retrieve sensitive unencrypted data (such as password hashes) that should be hidden from them. An attacker with limited API access could extract sensitive credentials and information meant to be protected.
Technical details
The vulnerability exists in Directus's API query parameter handling for field aliasing. When redacted/hashed fields (configured to return ******** placeholders) are accessed through the alias parameter (e.g., ?alias[hash]=password), the API returns the raw unredacted value instead of the masked version. This bypasses intended field-level access controls. The attack requires network access to the API and valid authentication with read permissions on the affected collections, but no further user interaction. An attacker can extract plaintext password hashes and other sensitive data that role-based permissions intended to hide. The vulnerability was fixed in version 10.11.0.
Affected products
- Directus Directus before 10.11.0
Timeline
- 2024-05-13: disclosed: Published in GitHub Security Advisory
- 2024-05-13: patched: Fixed in version 10.11.0