CVE-2025-30353
Published: 26 March 2025
Summary
CVE-2025-30353 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Monospace Directus. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-30353 is an information disclosure vulnerability in Directus, a real-time API and app dashboard for managing SQL database content. It affects versions starting from 9.12.0 up to but not including 11.5.0. The issue occurs in Flows configured with a Webhook trigger and the "Data of Last Operation" response body setting. When such a Flow encounters a ValidationError from a failed condition operation, the API response leaks sensitive data, including environmental variables, sensitive API keys, user accountability information, and operational data. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) and is associated with CWE-200.
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required. By triggering a Flow via its Webhook endpoint in a way that causes a ValidationError in a condition operation—such as sending a malformed payload—they receive an API response containing the exposed sensitive data. This scope-changing attack (S:C) results in high confidentiality impact (C:H), enabling potential misuse of the leaked credentials, keys, or operational details for further compromise.
The Directus security advisory (GHSA-fm3h-p9wm-h74h) confirms that upgrading to version 11.5.0 resolves the issue by preventing the inclusion of sensitive data in error responses. Security practitioners should prioritize patching affected Directus instances and review any Flows using Webhook triggers with "Data of Last Operation" response bodies for exposure risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8237
Vulnerability details
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError…
more
thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of the public-facing Directus webhook trigger leaks sensitive environmental variables, API keys, user accountability data, and operational information, enabling initial access via public-facing app exploitation and credential access via targeted exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires the system to handle errors and exceptions without compromising sensitive information, directly preventing disclosure of environmental variables, API keys, and operational data in ValidationError API responses.
Ensures identification, reporting, and timely remediation of flaws, directly addressing this information disclosure vulnerability fixed by upgrading to Directus version 11.5.0.
Filters sensitive information from API output responses, mitigating leakage in webhook Flow error bodies triggered by failed conditions.