Uninitialized Memory Exposure Affecting @directus/api package, versions <25.0.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-DIRECTUSAPI-9535507
- published27 Mar 2025
- disclosed26 Mar 2025
- creditdzevs
Introduced: 26 Mar 2025
NewCVE-2025-30353 (opens in a new tab)How to fix?
Upgrade @directus/api to version 25.0.0 or higher.
Overview
@directus/api is a real-time API and App dashboard for managing SQL database content
Affected versions of this package are vulnerable to Uninitialized Memory Exposure via the webhook trigger flows. An attacker can access sensitive data, including environmental variables, API keys, and user details, by triggering a flow with a failed condition.
PoC
Create a Flow in Directus with
Trigger: WebhookandResponse Body: Data of Last Operation;Add a condition that is likely to fail;
Trigger the Flow with any input data that will fail the condition;
Observe the API response, which includes sensitive information.