In breve
- CVE-2025-30353 è una vulnerabilità ALTO (CVSS 7.5) che riguarda directus (monospace), directus.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.53%, superiore al 44.6% delle vulnerabilità.
- Correzione: aggiornare a 11.5.0 o successiva.
| Package | Affected versions | Patched versions |
|---|
| directus | ≥ 9.12.0, < 11.5.0
| 11.5.0
|
| directus npm | ≥ 9.12.0, < 11.5.0
| 11.5.0
|
Description
Describe the Bug
In Directus, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.
This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.
To Reproduce
Steps to Reproduce:
- Create a Flow in Directus with:
- Trigger: Webhook
- Response Body: Data of Last Operation
- Add a condition that is likely to fail.
- Trigger the Flow with any input data that will fail the condition.
- Observe the API response, which includes sensitive information like:
- Environmental variables (
$env)
- Authorization headers
- User details under
$accountability
- Previous operational data.
Expected Behavior:
In the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.
Actual Behavior:
The API response includes sensitive information such as:
- Environment keys (
FLOWS_ENV_ALLOW_LIST)
- User accountability (
role, user, etc.)
- Operational logs (
current_payments, $last), which might contain private details.
NVD description
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free