{"id":"CVE-2024-34708","aliases":["GHSA-p8v3-m643-4xqx"],"url":"https://o3.security/vulnerability/CVE-2024-34708","summary":"Directus allows redacted data extraction on the API through \"alias\"","details":"## Summary\nA user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API.\nNormally, these redacted fields will return `**********` however  if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain text value for the field.\n\n## Steps to reproduce\n- Set up a simple role with read-access to users.\n- Create a new user with the role from the previous step\n- Assign a password to the user\n\nThe easiest way to confirm this vulnerability is by first visiting `/users/me`. You should be presented with a redacted JSON-object.\nNext, visit `/users/me?alias[hash]=password`. This time, the returned JSON object will included the raw password hash instead of the redacted value.\n\n## Workaround\nThis can be avoided by removing permission to view the sensitive fields entirely from users or roles that should not be able to see them.","published":"2024-05-13T19:33:55.305Z","modified":"2026-10-28T02:31:13.835536138Z","cvss":{"score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"directus","fixedVersion":"10.11.0"}],"fix":{"url":"https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b","label":"directus/directus@e70a90c"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34708.json"},{"type":"ADVISORY","url":"https://github.com/directus/directus/security/advisories/GHSA-p8v3-m643-4xqx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34708"},{"type":"FIX","url":"https://github.com/directus/directus/commit/e70a90c267bea695afce6545174c2b77517d617b"},{"type":"PACKAGE","url":"https://github.com/directus/directus"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:13.835536138Z"}}