CVE-2024-47822

Executive Summary

CVE-2024-47822 is a medium-severity information disclosure vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The vulnerability arises because access tokens passed via query strings are not redacted when the LOG_STYLE is set to raw. This can lead to sensitive tokens being written to system logs, which if not properly secured, could be accessed by an attacker. The CVSS score is 4.2, indicating a moderate risk. The vulnerability has been patched in version 10.13.2. Users are advised to upgrade immediately and rotate any static tokens that may have been exposed.

Supply Chain & Package Security

Directus is an open-source project distributed via npm. The vulnerability affects the core application logic and is not a supply chain compromise. However, users should verify the integrity of their Directus installation and ensure they are using the official package from the npm registry.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the potential for token leakage, which could lead to unauthorized access if the logs are compromised.

Deep Dive & Mechanics

The vulnerability is rooted in how Directus handles logging. When LOG_STYLE is set to raw, the application logs the raw HTTP request, including query parameters. The access_token parameter in the query string is not sanitized or redacted before being written to the log. This means that any token passed via the URL (e.g., ?access_token=...) will be stored in plaintext in the system logs.

An attacker who gains access to these logs (e.g., through a separate vulnerability, misconfigured log storage, or insider threat) can extract the tokens. If the token is a long-lived static token, the attacker can use it to authenticate to the Directus API and potentially gain administrative control, leading to unauthorized data access and manipulation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-10.13.2):

// In a logging middleware or handler
app.use((req, res, next) => {
  if (process.env.LOG_STYLE === 'raw') {
    console.log(JSON.stringify(req.query)); // No redaction
  }
  next();
});

Patched Code (10.13.2+):

// In a logging middleware or handler
app.use((req, res, next) => {
  if (process.env.LOG_STYLE === 'raw') {
    const sanitizedQuery = { ...req.query };
    if (sanitizedQuery.access_token) {
      sanitizedQuery.access_token = 'REDACTED';
    }
    console.log(JSON.stringify(sanitizedQuery));
  }
  next();
});

The patch explicitly checks for the access_token parameter and replaces its value with 'REDACTED' before logging.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Directus instance with LOG_STYLE set to raw (version < 10.13.2).
• Access to the system logs (e.g., via a log file, syslog, or cloud logging service).

Exploitation Steps:

1. Identify Target: Find a Directus instance that uses LOG_STYLE=raw.
2. Trigger Token Usage: Send a request to the Directus API with an access_token in the query string:

   GET /items/users?access_token=my_static_token_12345
   

3. Access Logs: Gain access to the system logs (e.g., via a separate vulnerability, misconfigured S3 bucket, or log aggregation service).
4. Extract Token: Search the logs for access_token entries.
5. Authenticate: Use the extracted token to authenticate to the Directus API and perform actions.

Example Log Entry:

{"access_token":"my_static_token_12345","fields":"*"}

Blue Team

Detection:

• Monitor for requests containing access_token in the query string.
• Alert on any log entries containing access_token followed by a non-redacted value.
• Use the Sigma rule provided in the Detection Engineering section.

Prevention:

• Upgrade to Directus 10.13.2 or later.
• Set LOG_STYLE to a safer option (e.g., combined or dev) if raw logging is not required.
• Rotate all static tokens that may have been exposed.
• Implement log access controls and encryption.

Indicators of Compromise (IOCs)

• Log Entries: Log entries containing access_token followed by a non-redacted value.
• Network Traffic: HTTP requests with access_token in the query string.
• File Hashes: N/A (no specific file hashes for this vulnerability).
• IP Addresses: N/A (depends on attacker infrastructure).

Detection Engineering

YARA Rule

rule CVE_2024_47822_Directus_Token_Leak {
  meta:
    description = "Detects Directus access token leakage in logs"
    author = "Valters IT"
    date = "2024-10-01"
    reference = "CVE-2024-47822"
  strings:
    $token = /access_token=[^& ]+/
  condition:
    $token
}

Sigma Rule

title: Directus Access Token in Log
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Directus access token in log entries
author: Valters IT
date: 2024-10-01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-47822
logsource:
  category: application
  product: directus
detection:
  selection:
    - EventData: "*access_token*"
  condition: selection
falsepositives:
  - Legitimate logging of redacted tokens (after patch)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47822 Directus Access Token in Query"; flow:to_server; content:"access_token"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Directus version 10.13.2 or later.
2. Token Rotation: Rotate all static tokens that may have been provided via query strings.
3. Log Configuration: Change LOG_STYLE to a safer option (e.g., combined or dev) if raw logging is not required.
4. Log Security: Ensure logs are stored securely with access controls and encryption.
5. Monitoring: Implement the detection rules provided in this report to monitor for token leakage.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert