CVE-2024-34708: Directus allows redacted data extraction on the API through "alias"

May 13, 2024

A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the alias functionality on the API. Normally, these redacted fields will return ********** however if we change the request to ?alias[workaround]=redacted we can instead retrieve the plain text value for the field.

References

github.com/advisories/GHSA-p8v3-m643-4xqx
github.com/directus/directus
github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b
github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx
nvd.nist.gov/vuln/detail/CVE-2024-34708

Code Behaviors & Features

Detect and mitigate CVE-2024-34708 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →