🛡️ CVE-2024-34708 — directus

🟡 CVSS 4.9 — Medium ⚠️ Exploit Public CWE-200 OSV
4.9
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Directus allows redacted data extraction on the API through "alias"

Summary

A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the alias functionality on the API.

Normally, these redacted fields will return ** however if we change the request to ?alias[workaround]=redacted we can instead retrieve the plain text value for the field.

Steps to reproduce

  • Set up a simple role with read-access to users.
  • Create a new user with the role from the previous step
  • Assign a password to the user

The easiest way to confirm this vulnerability is by first visiting /users/me. You should be presented with a redacted JSON-object.

Next, visit /users/me?alias[hash]=password. This time, the returned JSON object will included the raw password hash instead of the redacted value.

Workaround

This can be avoided by removing permission to view the sensitive fields entirely from users or roles that should not be able to see them.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs administrative privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity none, availability none.

Weakness class

CVE-2024-34708 is classified as CWE-200: Exposure of Sensitive Information. Information that should stay internal is disclosed to someone who is not authorised to see it.

Affected software

CVE-2024-34708 is recorded against 1 package.

  • directus

Timeline and source

Published on 13 May 2024 and last revised on 17 June 2026. A public exploit is known to exist, which raises the urgency of patching considerably. A vendor advisory or fix has been published. Record sourced from OSV.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Package)

Details

Severity MEDIUM
CVSS Score 4.9
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE CWE-200
Public Exploit ⚠️ Yes
Source OSV
Published 2024-05-13
Updated 2026-08-12
Modified 2026-06-17

Affected Packages

Software From version Fixed in
directus — —

Similar Threats

Exploit Protection

Are you running directus?

CVE-2024-34708 carries CVSS 4.9 Medium rating and a public exploit already exists. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2024-34708 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesCVECVE 2024