CVE-2024-34708
📋 TL;DR
This vulnerability in Directus allows users with permission to view collections containing redacted hashed fields to bypass redaction and access the plaintext values using the alias parameter in API requests. Affected users are those with view permissions on collections containing sensitive redacted fields in Directus installations prior to version 10.11.0.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Exposure of sensitive plaintext data such as passwords, API keys, or other confidential information stored in redacted fields to unauthorized users.
Likely Case
Unauthorized access to sensitive information that should remain hidden, potentially leading to data breaches or privilege escalation.
If Mitigated
No exposure of sensitive data if proper field-level permissions are configured or the system is patched.
🎯 Exploit Status
Exploitation requires authenticated access with view permissions on affected collections. The technique is documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.11.0
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx
Restart Required: Yes
Instructions:
1. Backup your Directus instance and database. 2. Update Directus to version 10.11.0 or later using your package manager or deployment method. 3. Restart the Directus service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Remove sensitive field view permissions
allRevoke permission to view fields containing sensitive data from users or roles that should not access them.
Use Directus permissions interface to modify role permissions
🧯 If You Can't Patch
- Implement strict field-level permissions to prevent unauthorized users from viewing sensitive fields entirely.
- Monitor API logs for suspicious alias parameter usage and implement WAF rules to block such requests.
🔍 How to Verify
Check if Vulnerable:
Test if authenticated API requests with ?alias[workaround]=redacted parameter return plaintext values from redacted fields.Check Version:
Check Directus admin interface or run: node -e "console.log(require('./package.json').version)" in Directus root directoryVerify Fix Applied:
After patching, verify that alias parameter no longer bypasses redaction and returns only masked values.📡 Detection & Monitoring
Log Indicators:
- API requests containing 'alias[workaround]' parameter
- Unusual access patterns to redacted fields
Network Indicators:
- HTTP requests with alias parameter targeting redacted field endpoints
SIEM Query:
http.url:*alias*workaround* AND http.method:GET🔗 References
- https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b
- https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx
- https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b
- https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx
