CVE-2025-30353

HighPublic PoC

Published: 26 March 2025

Published

26 March 2025

Modified

26 August 2025

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0036 58.0th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30353 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Monospace Directus. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-11 Error Handling good match

prevent

Requires the system to handle errors and exceptions without compromising sensitive information, directly preventing disclosure of environmental variables, API keys, and operational data in ValidationError API responses.

SI-2 Flaw Remediation good match

prevent

Ensures identification, reporting, and timely remediation of flaws, directly addressing this information disclosure vulnerability fixed by upgrading to Directus version 11.5.0.

SI-15 Information Output Filtering partial match

prevent

Filters sensitive information from API output responses, mitigating leakage in webhook Flow error bodies triggered by failed conditions.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1212 Exploitation for Credential Access Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

attack.mitre.org →

Why these techniques?

Unauthenticated remote exploitation of the public-facing Directus webhook trigger leaks sensitive environmental variables, API keys, user accountability data, and operational information, enabling initial access via public-facing app exploitation and credential access via targeted exploitation.

NVD Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError…

thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.

Deeper analysisAI

CVE-2025-30353 is an information disclosure vulnerability in Directus, a real-time API and app dashboard for managing SQL database content. It affects versions starting from 9.12.0 up to but not including 11.5.0. The issue occurs in Flows configured with a Webhook trigger and the "Data of Last Operation" response body setting. When such a Flow encounters a ValidationError from a failed condition operation, the API response leaks sensitive data, including environmental variables, sensitive API keys, user accountability information, and operational data. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) and is associated with CWE-200.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required. By triggering a Flow via its Webhook endpoint in a way that causes a ValidationError in a condition operation—such as sending a malformed payload—they receive an API response containing the exposed sensitive data. This scope-changing attack (S:C) results in high confidentiality impact (C:H), enabling potential misuse of the leaked credentials, keys, or operational details for further compromise.

The Directus security advisory (GHSA-fm3h-p9wm-h74h) confirms that upgrading to version 11.5.0 resolves the issue by preventing the inclusion of sensitive data in error responses. Security practitioners should prioritize patching affected Directus instances and review any Flows using Webhook triggers with "Data of Last Operation" response bodies for exposure risks.