PT-2024-26122 · Directus · Directus

Elieehel · Published 2024-05-13 · Updated 2025-01-03 · CVE-2024-34708

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 10.11.0

Description A user with permission to view any collection using redacted hashed fields can access the raw stored version using the alias functionality on the API. Normally, these redacted fields return **********, but by changing the request to ?alias[workaround]=redacted, it is possible to retrieve the plain text value for the field. This issue can be exploited by visiting specific API endpoints, such as /users/me and then /users/me?alias[hash]=password, to obtain the raw password hash instead of the redacted value.

Recommendations For versions prior to 10.11.0, remove permission to view sensitive fields entirely from users or roles that should not be able to see them. This can be done by adjusting the roles and permissions settings in the Directus dashboard to restrict access to sensitive information. As a temporary workaround, consider restricting access to the alias functionality on the API until the issue is resolved by updating to version 10.11.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-34708

GHSA-P8V3-M643-4XQX

Affected Products

Directus

References · 8

• 🔥 https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34708.json · Exploit
• https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-34708 · Security Note
• https://osv.dev/vulnerability/GHSA-p8v3-m643-4xqx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34708 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://t.me/cvenotify/106178 · Telegram Post