Listen to this Post
How the CVE Works
Directus logs all incoming request details in Flow logs when using WebHook triggers, including sensitive session tokens stored in cookies. These logs are accessible to admin users, exposing authentication credentials. Attackers with admin privileges can extract these tokens and hijack user sessions before expiration. The vulnerability stems from insufficient redaction of sensitive data in debug logs.
DailyCVE Form:
Platform: Directus
Version: <10.x
Vulnerability: Token exposure
Severity: Moderate
Date: Jul 14, 2025
Prediction: Patch by Aug 2025
What Undercode Say
grep -r "access_token" /var/log/directus/flows curl -H "Cookie: refresh_token=LEAKED" http://victim.com/api/auth
How Exploit
1. Gain admin access to Directus.
2. Retrieve logs containing unredacted tokens.
3. Use stolen tokens for session hijacking.
Protection from this CVE
- Disable detailed Flow logging.
- Apply patch redacting tokens.
- Restrict admin log access.
Impact
- Session hijacking.
- Privilege escalation.
- Data breaches.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
