Directus Eskalation von Privilegien mithilfe der Share-Funktion (Privilege Escalation vulnerability using Share feature)

An attacker exploiting this vulnerability could leverage the item sharing feature to elevate their privileges within the Directus application. By specifying a higher-privileged role during the sharing process, a typical user could gain unauthorized access to sensitive data fields that are normally restricted to those roles. This could lead to data breaches, unauthorized modifications, or other malicious activities. The impact is particularly significant in environments where role-based access control is critical for data security and compliance. The blast radius is limited to the Directus instance and the data it manages, but the potential for unauthorized access makes this a serious concern.

Organizations using Directus for content management, particularly those with complex role-based access control configurations and who utilize the item sharing feature, are at risk. Shared hosting environments where multiple users share a Directus instance are also potentially vulnerable.

• nodejs: Monitor Directus logs for suspicious activity related to item sharing and role assignments. Look for requests containing unexpected or elevated roles.

grep -i 'role assignment|sharing request' /var/log/directus/directus.log

• generic web: Check Directus API endpoints for unauthorized access attempts. Use curl to test sharing functionality with different user roles.

curl -X POST -H "Content-Type: application/json" -d '{"role":"admin"}' <directus_api_url>/items/<item_id>/share

1. 2025-01-23Disclosure

   disclosure

1. Reserviert2025-01-20
2. Veröffentlicht2025-01-23
3. Geändert2025-02-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-24353 is to upgrade Directus to version 11.2.0 or later, which includes the necessary patch. If immediate upgrading is not possible, consider temporarily restricting the use of the item sharing feature or carefully reviewing and tightening role-based access controls within Directus. Implement stricter validation of user input when configuring sharing permissions. Regularly audit Directus configurations to ensure role hierarchies are properly defined and enforced. After upgrading, confirm the fix by attempting to share an item with a user and verifying that they only have access to the intended fields.