{"id":"GHSA-p8v3-m643-4xqx","summary":"Directus allows redacted data extraction on the API through \"alias\"","details":"## Summary\nA user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API.\nNormally, these redacted fields will return `**********` however  if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field.\n\n## Steps to reproduce\n- Set up a simple role with read-access to users.\n- Create a new user with the role from the previous step\n- Assign a password to the user\n\nThe easiest way to confirm this vulnerability is by first visiting `/users/me`. You should be presented with a redacted JSON-object.\nNext, visit `/users/me?alias[hash]=password`. This time, the returned JSON object will included the raw password hash instead of the redacted value.\n\n## Workaround\nThis can be avoided by removing permission to view the sensitive fields entirely from users or roles that should not be able to see them.","aliases":["CVE-2024-34708"],"modified":"2024-05-19T02:24:46.715961Z","published":"2024-05-13T19:40:08Z","related":["CVE-2024-34708"],"database_specific":{"cwe_ids":["CWE-200"],"github_reviewed_at":"2024-05-13T19:40:08Z","github_reviewed":true,"nvd_published_at":"2024-05-14T15:39:31Z","severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34708"},{"type":"WEB","url":"https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b"},{"type":"PACKAGE","url":"https://github.com/directus/directus"}],"affected":[{"package":{"name":"directus","ecosystem":"npm","purl":"pkg:npm/directus"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"10.11.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-p8v3-m643-4xqx/GHSA-p8v3-m643-4xqx.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}]}