Information Exposure Affecting directus package, versions <10.11.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-DIRECTUS-6839436
- published 14 May 2024
- disclosed 13 May 2024
- credit elieehel
Introduced: 13 May 2024
CVE-2024-34708 Open this link in a new tabHow to fix?
Upgrade directus to version 10.11.0 or higher.
Overview
directus is a Directus is a real-time API and App dashboard for managing SQL database content.
Affected versions of this package are vulnerable to Information Exposure through the alias functionality. An attacker can access sensitive data by manipulating the API request parameters.
Notes:
This is only exploitable if the user has permissions to view any collection using redacted hashed fields.
Steps to reproduce:
Set up a simple role with read-access to users.
Create a new user with the role from the previous step
Assign a password to the user
To confirm this vulnerability, visit /users/me. You should be presented with a redacted JSON-object. Next, visit /users/me?alias[hash]=password. This time, the returned JSON object will included the raw password hash instead of the redacted value.