CVE-2025-24353
📋 TL;DR
This vulnerability in Directus allows users with typical permissions to specify arbitrary roles when sharing items, potentially granting access to fields they shouldn't see. It affects instances using the share feature with role hierarchies and field visibility restrictions. Only Directus versions before 11.2.0 are vulnerable.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users gain access to sensitive data fields by elevating their role permissions through shared items, potentially exposing confidential information.
Likely Case
Users with limited permissions can view data fields intended for higher-privileged roles, leading to information disclosure.
If Mitigated
With proper role-based access controls and monitoring, impact is limited to minor information leakage that can be quickly detected.
🎯 Exploit Status
Exploitation requires authenticated user access and knowledge of the share feature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.2.0
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg
Restart Required: Yes
Instructions:
1. Backup your Directus instance and database. 2. Update Directus to version 11.2.0 or later. 3. Restart the Directus service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Share Feature
allTemporarily disable the share functionality until patching is possible.
Modify Directus configuration to disable sharing features
Restrict Role Assignments
allImplement additional validation to prevent role escalation in share operations.
Add custom middleware to validate role permissions before sharing
🧯 If You Can't Patch
- Implement strict monitoring of share operations and role changes
- Review and audit all existing shared items for unauthorized role assignments
🔍 How to Verify
Check if Vulnerable:
Check if Directus version is below 11.2.0 and if share feature is enabled with role-based field restrictions.Check Version:
Check Directus admin interface or API for version informationVerify Fix Applied:
Confirm Directus version is 11.2.0 or later and test that users cannot specify arbitrary roles when sharing items.📡 Detection & Monitoring
Log Indicators:
- Unusual share operations with role changes
- Access to fields by users with insufficient permissions
Network Indicators:
- API calls to share endpoints with role parameters
SIEM Query:
Search for share operations where user role differs from assigned role in activity logs🔗 References
- https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804
- https://github.com/directus/directus/pull/23716
- https://github.com/directus/directus/releases/tag/v11.2.0
- https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg
- https://www.youtube.com/watch?v=DbV4IxbWzN4
