CVE-2025-53887

Executive Summary

CVE-2025-53887 is an information disclosure vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The vulnerability exists in versions 9.0.0 through 11.8.x, where the exact Directus version number is incorrectly used as the OpenAPI Spec version. This version string is exposed via the /server/specs/oas endpoint without requiring authentication. An unauthenticated attacker can retrieve the precise Directus version, enabling targeted exploitation of known vulnerabilities in that specific version or its dependencies. The CVSS score is 5.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. The fix is implemented in version 11.9.0.

Supply Chain & Package Security

Directus is distributed as an npm package (directus). The vulnerability affects the core application and does not directly impact the npm supply chain. However, the exposed version information can be used to identify vulnerable dependencies shipped with Directus, potentially enabling supply chain attacks if those dependencies have known vulnerabilities. Organizations should ensure they are using the latest patched version (11.9.0) and monitor for any dependency advisories.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (version disclosure)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the low complexity and no authentication requirement, but the direct impact is limited to information disclosure. However, the disclosed version can be a stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in the OpenAPI specification generation logic within Directus. The application uses its own version string (e.g., 11.8.0) as the version field in the OpenAPI spec output. This spec is served at the /server/specs/oas endpoint. Due to a missing authentication check, any unauthenticated user can access this endpoint and retrieve the full OpenAPI document, which includes the version number.

Root Cause: The endpoint /server/specs/oas does not enforce authentication, and the version string is directly taken from the application's internal version constant without sanitization or restriction.

Attack Scenario:

1. An attacker sends a GET request to https://target.com/server/specs/oas.
2. The server responds with a JSON document containing the OpenAPI spec, including the info.version field.
3. The attacker extracts the version (e.g., 11.8.0).
4. The attacker searches for known CVEs affecting that specific version or its dependencies.
5. The attacker then exploits those vulnerabilities to compromise the system.

Vulnerable vs. Patched Code

Vulnerable Code (pre-11.9.0):

// In the OpenAPI spec generation module
const openApiSpec = {
  openapi: '3.0.0',
  info: {
    title: 'Directus API',
    version: pkg.version, // Directly uses the package version
    description: '...'
  },
  // ...
};

// Endpoint handler without authentication
app.get('/server/specs/oas', (req, res) => {
  res.json(openApiSpec);
});

Patched Code (11.9.0):

// In the OpenAPI spec generation module
const openApiSpec = {
  openapi: '3.0.0',
  info: {
    title: 'Directus API',
    version: '1.0.0', // Static version, not the actual Directus version
    description: '...'
  },
  // ...
};

// Endpoint handler with authentication middleware
app.get('/server/specs/oas', authenticate, (req, res) => {
  res.json(openApiSpec);
});

The patch replaces the dynamic version with a static string and adds authentication to the endpoint.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Directus instance (e.g., version 11.8.0) using Docker:

   docker run -d -p 8055:8055 --name directus-vuln directus/directus:11.8.0
   

2. Access the instance and ensure it is running.

Exploitation Steps:

1. Send a request to the vulnerable endpoint:

   curl -s http://localhost:8055/server/specs/oas | jq '.info.version'
   

2. The response will contain the version, e.g., "11.8.0".
3. Use this version to search for known vulnerabilities (e.g., in CVE databases or exploit databases).

No exploit code is provided in the Hacker Arsenal.

Blue Team

Detection:

• Monitor for requests to /server/specs/oas from unauthenticated sources.
• Alert on any successful retrieval of the OpenAPI spec without a valid session token.

Hunting:

• Search logs for GET /server/specs/oas with HTTP status 200.
• Correlate with IP addresses that have no prior authentication events.

Mitigation:

• Immediately upgrade to Directus 11.9.0.
• If upgrade is not possible, implement a reverse proxy rule to block unauthenticated access to /server/specs/oas.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /server/specs/oas from unknown IPs.
• Logs: Access log entries showing GET /server/specs/oas with status 200 and no preceding authentication.
• File: No file-based IOCs.
• Registry: No registry-based IOCs.

Detection Engineering

YARA Rule

rule detect_directus_version_disclosure {
    meta:
        description = "Detects Directus version disclosure via OpenAPI spec endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53887"
    strings:
        $oas_path = "/server/specs/oas"
        $version_pattern = /"version":\s*"\d+\.\d+\.\d+"/
    condition:
        $oas_path and $version_pattern
}

Sigma Rule

title: Directus Version Disclosure via OpenAPI Spec
id: d8f3a2c1-5b7e-4a9d-8c6f-2e1b3a4d5c6f
status: experimental
description: Detects unauthenticated access to the Directus OpenAPI spec endpoint that discloses the version.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53887
logsource:
    category: webserver
    product: directus
detection:
    selection:
        cs-method: GET
        cs-uri-stem: /server/specs/oas
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate API clients with valid authentication (if authentication is enforced)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53887 Directus Version Disclosure"; flow:to_server; content:"GET"; http_method; content:"/server/specs/oas"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Directus to version 11.9.0 or later.
2. If upgrade is not possible, implement a WAF rule to block unauthenticated requests to /server/specs/oas.
3. Restrict network access to the Directus API to trusted IPs only.

Long-term Measures:

• Regularly update Directus and its dependencies.
• Implement proper authentication for all API endpoints.
• Conduct regular security audits and penetration testing.

Workaround:

• Use a reverse proxy (e.g., Nginx) to add authentication:

  location /server/specs/oas {
      auth_basic "Restricted";
      auth_basic_user_file /etc/nginx/.htpasswd;
      proxy_pass http://directus:8055;
  }
  

Valters IT
DevSecOps & Cyber Threat Intelligence Expert