CVE-2024-47822: Directus inserts access token from query string into logs
Summary Access token from query string is not redacted and is potentially exposed in system logs which may be persisted.
Details The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation.
PoC 1. Set LOGLEVEL="raw" in the environment. 2. Send a request with the accesstoken in the query string. 3. Notice that the accesstoken in req.query is not redacted.
Impact It impacts systems where the LOGSTYLE is set to raw. The accesstoken in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string.
Other sources
Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the LOGSTYLE is set to raw. The accesstoken in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47822?
CVE-2024-47822 is considered a high severity vulnerability due to the potential exposure of sensitive access tokens.
How do I fix CVE-2024-47822?
To mitigate CVE-2024-47822, ensure that the LOG_STYLE is not set to 'raw' to prevent access tokens from being logged.
What impact does CVE-2024-47822 have on users?
CVE-2024-47822 can lead to unauthorized access if an attacker gains access to logs containing unredacted access tokens.
Which versions of Directus are affected by CVE-2024-47822?
CVE-2024-47822 affects Directus versions before 10.13.2.
Is there a workaround for CVE-2024-47822?
A workaround for CVE-2024-47822 includes using alternative logging configurations that do not expose sensitive information.