Listen to this Post
How the CVE Works
The vulnerability occurs in Directus’ OpenAPI specification endpoint (/server/specs/oas), which exposes the exact version number of the running instance without requiring authentication. This happens because the API specification dynamically includes the Directus version as its own version metadata. Attackers can query this endpoint to retrieve the version and then cross-reference it with known vulnerabilities in Directus or its dependencies, facilitating targeted exploits.
DailyCVE Form
Platform: Directus
Version: All (up to patched version)
Vulnerability: Information Disclosure
Severity: Moderate
Date: 2025-07-14
Prediction: Patch expected by 2025-07-21
What Undercode Say
curl -X GET http://<target>/server/specs/oas | grep "version"
import requests
response = requests.get("http://<target>/server/specs/oas").json()
print(response["info"]["version"])
How Exploit
1. Query `/server/specs/oas` endpoint.
2. Extract version from response metadata.
3. Search for known exploits matching the version.
Protection from this CVE
- Restrict endpoint access.
- Mask version in API spec.
- Update to patched version.
Impact
- Version enumeration.
- Targeted exploitation.
- Dependency chain attacks.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
