CVE-2023-28443: Insertion of Sensitive Information into Log File

March 24, 2023 (updated March 29, 2023)

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the directus_refresh_token is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.

References

github.com/advisories/GHSA-8vg2-wf3q-mwv7
github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts
github.com/directus/directus/commit/349536303983ccba68ecb3e4fb35315424011afc
github.com/directus/directus/security/advisories/GHSA-8vg2-wf3q-mwv7

Code Behaviors & Features

Detect and mitigate CVE-2023-28443 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →