CVE-2025-30352

Executive Summary

CVE-2025-30352 is an information disclosure vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The flaw resides in the search query parameter, which allows authenticated users with access to a collection to filter items based on fields they do not have permission to view. This enables the enumeration of unknown field contents by injecting where clauses without proper permission checks. The vulnerability affects versions from 9.0.0-alpha.4 up to (but not including) 11.5.0. The CVSS score is 5.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

Directus is a Node.js application distributed via npm. The vulnerability exists in the core application logic, not in a third-party dependency. Organizations using Directus should verify their installed version and update to 11.5.0 or later. The package is available on npm as directus.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated access to a collection
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – allows enumeration of field contents
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is considered Medium due to the requirement for authentication and the limited impact (confidentiality only). However, the ability to enumerate hidden fields could lead to further attacks if sensitive data is exposed.

Deep Dive & Mechanics

The vulnerability is rooted in how Directus handles the search query parameter when querying collections. The search parameter is intended to allow users to filter items based on a search term across multiple fields. However, the implementation does not verify whether the user has permission to view the fields being searched.

When a user with access to a collection sends a request with a search parameter, Directus constructs SQL WHERE clauses that include columns from the collection. The searchable columns (numbers and strings) are injected into the query without checking the user's field-level permissions. This allows an attacker to infer the existence and content of fields they should not be able to see by observing the results of search queries.

For example, if a collection has a hidden field secret_code, an attacker could search for specific values and observe whether any results are returned, thereby enumerating the contents of that field.

The fix in version 11.5.0 ensures that the search query parameter only applies to fields the user has permission to view.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the query builder or permission middleware. The following is a conceptual comparison:

Vulnerable (simplified):

// In query builder, search parameter is applied without permission check
if (search) {
  query.where(function() {
    this.where('field1', 'like', `%${search}%`)
        .orWhere('field2', 'like', `%${search}%`)
        // ... all fields, including hidden ones
  });
}

Patched (simplified):

// In query builder, search parameter is applied only to permitted fields
const permittedFields = getPermittedFields(user, collection);
if (search) {
  query.where(function() {
    permittedFields.forEach(field => {
      this.orWhere(field, 'like', `%${search}%`);
    });
  });
}

The patched version filters the fields used in the search query based on the user's permissions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Directus instance (version < 11.5.0)
• Valid credentials for a user with access to a collection containing hidden fields

Exploitation Steps:

1. Identify a collection with hidden fields (e.g., secret_code).
2. Send a request to the Directus API with a search parameter targeting the hidden field.

   GET /items/collection?search=test_value HTTP/1.1
   Host: directus.example.com
   Authorization: Bearer <token>
   

3. Observe the response. If results are returned, the hidden field contains the search term.
4. Iterate through possible values to enumerate the field contents.

Example using curl:

curl -H "Authorization: Bearer <token>" "https://directus.example.com/items/collection?search=secret_value"

Blue Team

Detection:

• Monitor API logs for unusual search parameter usage, especially from users who should not have access to certain fields.
• Look for patterns of repeated search queries with different values, indicating enumeration attempts.

Prevention:

• Upgrade to Directus 11.5.0 or later.
• Implement additional logging and alerting for suspicious search activity.
• Review field-level permissions and ensure they are correctly configured.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Directus API endpoints with search parameter containing unusual or repetitive values.
• Logs: API access logs showing multiple search queries from the same user targeting different values.
• Application: Directus version < 11.5.0.

Detection Engineering

YARA Rule

rule Detect_Directus_Search_Enumeration {
    meta:
        description = "Detects potential enumeration of hidden fields via search parameter in Directus"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30352"
    strings:
        $search_param = "search="
        $api_path = "/items/"
    condition:
        $search_param and $api_path
}

Sigma Rule

title: Directus Search Parameter Enumeration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential enumeration of hidden fields via search parameter in Directus
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30352
logsource:
    category: webserver
    product: directus
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'search='
        cs-uri-pattern: '/items/*'
    condition: selection
falsepositives:
    - Legitimate search functionality usage
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30352 Directus Search Parameter Enumeration"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/items/"; http.uri; content:"search="; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Directus to version 11.5.0 or later.
• If immediate upgrade is not possible, restrict access to the API and monitor for suspicious search activity.

Long-term:

• Implement field-level permissions and ensure they are enforced in all query operations.
• Conduct regular security audits of the Directus configuration.
• Monitor for new CVEs and apply patches promptly.

Workarounds:

• Disable the search functionality for sensitive collections if possible.
• Use a Web Application Firewall (WAF) to block suspicious search patterns.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert