CVE-2025-53885

Executive Summary

CVE-2025-53885 is a medium-severity information disclosure vulnerability affecting Directus, a real-time API and App dashboard for managing SQL database content. The vulnerability resides in the Directus Flows feature, specifically in the "Log to Console" operation. A malicious administrator with access to Flows can configure a template string that logs sensitive data from other users during user creation or update events. This allows an attacker with administrative privileges to exfiltrate sensitive information such as passwords, tokens, or personal data by capturing it in console logs. The vulnerability affects versions from 9.0.0 up to (but not including) 11.9.0. The fix is available in version 11.9.0, and the recommended workaround is to avoid logging sensitive data to console outside of development contexts.

Supply Chain & Package Security

Directus is a Node.js application distributed via npm. The vulnerability is introduced through the application's own code, not a third-party dependency. However, administrators should ensure that their Directus installation is updated to the latest patched version (11.9.0 or later) to mitigate this risk. No malicious packages or compromised dependencies have been identified in relation to this CVE.

CVSS Breakdown & Threat Level

CVSS Score: 4.2 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): High – An attacker must have administrative access to Directus to create or modify Flows.
• User Interaction (UI): None – No user interaction is required for exploitation.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited sensitive data may be disclosed.
• Integrity (I): None – No data integrity is affected.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. The vulnerability requires administrative privileges, which limits the attack surface. However, if an attacker gains admin access, they can silently exfiltrate sensitive user data through console logs.

Deep Dive & Mechanics

The vulnerability is rooted in the Directus Flows feature, which allows administrators to automate workflows based on events such as user creation or update. The "Log to Console" operation within Flows can be configured with a template string that references event data. When a user is created or updated, the Flow triggers and logs the specified data to the console. If a malicious admin configures the template to include sensitive fields (e.g., {{$trigger.payload.password}} or {{$trigger.payload.token}}), that data will be written to the server's console output.

The core issue is that Directus does not sanitize or restrict the fields that can be logged via Flows. The "Log to Console" operation is intended for debugging, but it can be abused to capture sensitive information from other users' events. The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File), as it involves logging sensitive data that could be accessed by an attacker with access to the server logs.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-11.9.0): In the vulnerable version, the log-to-console operation directly evaluates the template string without filtering sensitive fields. For example, in the Flow configuration, an admin could set the template to:

{
  "operation": "log-to-console",
  "template": "User created: {{$trigger.payload.email}} - Password: {{$trigger.payload.password}}"
}

This would log the password to the console when a user is created.

Patched Code (11.9.0+): The patched version introduces a blocklist or sanitization mechanism that prevents sensitive fields (e.g., password, token, secret) from being logged. The template engine now checks for these fields and either redacts them or throws an error. The exact implementation may involve filtering the $trigger.payload object to exclude known sensitive keys before rendering the template.

Example of patched behavior:

{
  "operation": "log-to-console",
  "template": "User created: {{$trigger.payload.email}} - Password: {{$trigger.payload.password}}"
}

This would now log: User created: user@example.com - Password: [REDACTED] or fail with an error.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to a Directus instance (version 9.0.0 to 11.8.x).
• Ability to create or modify Flows.

Exploitation Steps:

1. Log in to Directus as an administrator.
2. Navigate to Settings > Flows.
3. Create a new Flow or edit an existing one.
4. Set the trigger to Users > User Created or Users > User Updated.
5. Add an operation of type Log to Console.
6. In the template field, enter a string that includes sensitive data, e.g.:

   New user: {{$trigger.payload.email}} - Password: {{$trigger.payload.password}}
   

7. Save the Flow.
8. Wait for a user creation or update event to occur.
9. Access the server console logs (e.g., via docker logs, journalctl, or log files) to view the captured sensitive data.

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor for unusual Flow configurations that include "Log to Console" operations with templates referencing sensitive fields.
• Audit all existing Flows for any that log user data, especially fields like password, token, secret, or api_key.
• Review server logs for any instances of sensitive data being written to console.

Prevention:

• Upgrade to Directus 11.9.0 or later.
• Restrict administrative access to trusted personnel only.
• Implement logging best practices: never log sensitive data in production.
• Use a Web Application Firewall (WAF) or API gateway to monitor and block suspicious API calls.

Indicators of Compromise (IOCs)

• Log Entries: Server logs containing plaintext passwords, tokens, or other sensitive user data.
• Flow Configurations: Flows with "Log to Console" operations that include template strings referencing $trigger.payload.password, $trigger.payload.token, or similar sensitive fields.
• API Calls: Unusual API calls to /flows or /operations endpoints by administrative users.
• Network Traffic: Outbound connections from the Directus server to external logging services (if logs are forwarded).

Detection Engineering

YARA Rule

rule Detect_Directus_Sensitive_Logging {
    meta:
        description = "Detects Directus Flows logging sensitive user data to console"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53885"
    strings:
        $sensitive1 = "password" nocase
        $sensitive2 = "token" nocase
        $sensitive3 = "secret" nocase
        $sensitive4 = "api_key" nocase
        $log_op = "log-to-console"
        $template = "template"
    condition:
        $log_op and $template and any of ($sensitive*)
}

Sigma Rule

title: Directus Flows Logging Sensitive Data
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Directus Flows configured to log sensitive user data to console
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53885
logsource:
    product: directus
    service: flows
detection:
    selection:
        operation: "log-to-console"
        template|contains:
            - "password"
            - "token"
            - "secret"
            - "api_key"
    condition: selection
falsepositives:
    - Legitimate debugging in development environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53885 Directus Flows Sensitive Data Logging"; flow:to_server; content:"log-to-console"; http_client_body; content:"template"; http_client_body; content:"password"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Directus to version 11.9.0 or later.
2. Review and remove any existing Flows that log sensitive data.
3. Rotate any credentials or tokens that may have been exposed in logs.

Long-term Mitigations:

• Implement the principle of least privilege for administrative accounts.
• Enable audit logging for all Flow modifications.
• Regularly review server logs for sensitive data exposure.
• Use a centralized logging solution with data masking capabilities.

Workaround: If upgrading is not immediately possible, avoid using the "Log to Console" operation in production environments. If it must be used, ensure that no sensitive fields are included in the template string.

Valters IT
Securing Digital Frontiers