CVE-2025-53886
📋 TL;DR
This vulnerability in Directus logs sensitive authentication tokens when using WebHook triggers in Flows, exposing access and refresh tokens in system logs. Malicious administrators with log access can hijack user sessions within token expiration periods. Affects Directus versions 9.0.0 through 11.8.9.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Malicious admin steals access/refresh tokens from logs, hijacks user sessions, performs unauthorized actions as legitimate users, and potentially escalates privileges or exfiltrates sensitive data.
Likely Case
Privileged insider or compromised admin account accesses logs containing tokens, hijacks sessions of users who triggered WebHook flows, and performs unauthorized operations within those sessions.
If Mitigated
With proper access controls and log monitoring, impact is limited to authorized administrators who already have significant system access.
🎯 Exploit Status
Exploitation requires administrative access to view system logs where tokens are recorded. No special tools or techniques needed beyond log access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.9.0
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v
Restart Required: Yes
Instructions:
1. Backup your Directus instance and database. 2. Update Directus to version 11.9.0 or later using your package manager (npm/yarn/pnpm). 3. Restart the Directus service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable WebHook Flow Logging
allDisable logging for WebHook triggers in Flows configuration to prevent token exposure
Modify Directus configuration to disable detailed logging for WebHook triggers
Restrict Log Access
linuxImplement strict access controls on log files and monitoring systems
chmod 640 /path/to/directus/logs/*
setfacl -m u:directus:r /path/to/directus/logs/
🧯 If You Can't Patch
- Implement strict role-based access control to limit who can view system logs
- Enable detailed audit logging for log access attempts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Directus version: if between 9.0.0 and 11.8.9 inclusive, and using WebHook triggers in Flows, system is vulnerable.Check Version:
npx directus version or check package.json for Directus versionVerify Fix Applied:
After updating to 11.9.0+, verify that WebHook trigger requests no longer log authentication tokens in system logs.📡 Detection & Monitoring
Log Indicators:
- Log entries containing 'access_token', 'refresh_token', or full cookie headers from WebHook trigger requests
- Administrative access to log files outside normal patterns
Network Indicators:
- Unusual session activity from administrative IP addresses
- Multiple session creations from single user in short timeframe
SIEM Query:
source="directus_logs" AND ("access_token" OR "refresh_token" OR "cookie:") AND "webhook"