CVE-2025-30353
📋 TL;DR
This vulnerability in Directus exposes sensitive data including environmental variables, API keys, and user information when a Flow with a Webhook trigger encounters a ValidationError. Attackers can exploit this to gain unauthorized access to sensitive information. Affected systems are Directus instances running versions 9.12.0 through 11.4.x.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through exposed API keys and environmental variables, leading to data breaches, privilege escalation, and complete system takeover.
Likely Case
Exposure of sensitive configuration data and user information, enabling further attacks and potential data exfiltration.
If Mitigated
Limited exposure of non-critical operational data with proper access controls and monitoring in place.
🎯 Exploit Status
Requires triggering specific error conditions in configured Flows. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.5.0
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-fm3h-p9wm-h74h
Restart Required: No
Instructions:
1. Update Directus to version 11.5.0 or later. 2. Run 'npm update directus' or use your package manager. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable vulnerable Flows
allTemporarily disable any Flows using Webhook triggers with 'Data of Last Operation' response body
Implement error handling middleware
allAdd custom middleware to sanitize error responses before they reach clients
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Directus instances
- Deploy WAF rules to filter error responses containing sensitive data patterns
🔍 How to Verify
Check if Vulnerable:
Check Directus version and review Flow configurations for Webhook triggers with 'Data of Last Operation' response bodyCheck Version:
directus versionVerify Fix Applied:
Confirm Directus version is 11.5.0 or later and test error responses from configured Flows📡 Detection & Monitoring
Log Indicators:
- Error responses containing environmental variables or API keys in logs
- Unusual ValidationError patterns in Flow execution logs
Network Indicators:
- HTTP responses containing sensitive data patterns in error payloads
- Unusual traffic to Flow endpoints
SIEM Query:
source="directus" AND ("ValidationError" OR "environment" OR "API_KEY") AND status=500