Executive brief
Directus is a headless CMS platform that allows users to create automated workflows (Flows) with webhook triggers. When a webhook-triggered flow with "Data of Last Operation" response handling encounters a validation error, the API response unintentionally exposes sensitive information including environment variables, API keys, user credentials, and internal operational data. This allows attackers to extract secrets and user information without authentication.
Technical details
The vulnerability exists in Directus's webhook trigger flow implementation when combined with the "Data of Last Operation" response body setting. When a ValidationError is thrown by a failed condition operation, the error response includes sensitive data from the flow execution context such as $env (environment variables), FLOWS_ENV_ALLOW_LIST configuration, $accountability (user role and identity), authorization headers, and $last (previous operational data). The vulnerability is triggered by sending any input to a webhook endpoint configured with a failing condition, and no authentication is required (AV:N, PR:N). Directus versions 9.12.0 through 11.4.x are affected; version 11.5.0 and later include the fix.
Affected products
- Directus directus 9.12.0 through 11.4.x
Timeline
- 2025-03-26: disclosed
- 2025-03-26: patched: Version 11.5.0 includes the fix