CVE-2024-47822
📋 TL;DR
Directus systems with LOG_STYLE set to 'raw' expose access tokens in query strings within system logs. Attackers with log access can steal these tokens to gain administrative control, leading to unauthorized data access and manipulation. This affects Directus deployments using raw logging and query string authentication.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains administrative access via stolen static tokens, leading to complete data compromise, manipulation, and potential system takeover.
Likely Case
Unauthorized data access and manipulation if logs containing tokens are exposed to attackers.
If Mitigated
Minimal impact if logs are properly secured and token rotation is implemented.
🎯 Exploit Status
Exploitation requires access to system logs containing unredacted tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.13.2 and later
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp
Restart Required: Yes
Instructions:
1. Upgrade Directus to version 10.13.2 or later. 2. Restart the Directus service. 3. Rotate any static tokens that were passed via query strings.
🧯 If You Can't Patch
- Change LOG_STYLE from 'raw' to another setting like 'pretty' or 'json'.
- Implement strict access controls and monitoring for system logs to prevent unauthorized access.
🔍 How to Verify
Check if Vulnerable:
Check if Directus version is below 10.13.2 and LOG_STYLE environment variable is set to 'raw'.Check Version:
Check Directus admin interface or run: node -e "console.log(require('./package.json').version)" in Directus directoryVerify Fix Applied:
Confirm Directus version is 10.13.2 or higher and verify logs no longer contain unredacted access tokens in query strings.📡 Detection & Monitoring
Log Indicators:
- Log entries containing 'access_token' parameter with visible token values in query strings.
Network Indicators:
- Unusual administrative access patterns or token reuse from unexpected sources.
SIEM Query:
Search logs for patterns matching 'access_token=[alphanumeric string]' in query parameters.