{"id":"CVE-2023-28443","aliases":["EUVD-2023-0951","GHSA-8vg2-wf3q-mwv7"],"status":"published","title":"directus vulnerable to Insertion of Sensitive Information into Log File","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00312,"percentile":0.24329,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-532"],"published":"2023-03-23T19:47:12Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"npm","package":"directus","fixed_in":["9.23.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"directus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.23.3"}]}]},{"source":"osv","ecosystem":"npm","package":"directus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.23.3"}]}]}],"products":[{"vendor":"directus","product":"directus"},{"vendor":"monospace","product":"directus"}],"references":[{"url":"https://github.com/directus/directus/security/advisories/GHSA-8vg2-wf3q-mwv7","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/directus/directus/commit/349536303983ccba68ecb3e4fb35315424011afc","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28443","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8vg2-wf3q-mwv7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28443.json","tags":["advisory"]},{"url":"https://github.com/directus/directus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-28443","title":"directus vulnerable to Insertion of Sensitive Information into Log File","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.","status":"published","published":"2023-03-23T23:13:58.299Z","modified":"2025-02-21T15:30:10.767Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532","CWE-284"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-0951","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.","status":"published","published":"2023-03-23T23:13:58Z","modified":"2025-02-21T15:30:10Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:25.922377Z"}],"ghsa":[{"id":"GHSA-8vg2-wf3q-mwv7","title":"directus vulnerable to Insertion of Sensitive Information into Log File","description":"### Summary\n\nCWE-532: Insertion of Sensitive Information into Log File discovered in v9.23.1. The `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. \n\n### Details\n\nUsing `v9.23.1`, I am seeing that the `directus_refresh_token` is not properly redacted as indicated by https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13\n\nI'm classifying this as a security vulnerability because if someone has access to the log outputs, for example with a shared Cloud account or Splunk implementation, they could exchange the refresh token using `/auth/refresh` for an access token and use the token to perform actions on behalf of an unsuspecting user. This situation creates issues with accountability and non-repudiation because we can no longer have confidence that actions taken in the application were authorized or even performed by the logged-in user. \n\nA couple of examples of this are:\n- A disgruntled employee deletes all of the data to get even with a target team member before logging off on their last day\n- Under the guise of their unsuspecting boss, a mischievous engineer uploads _questionable_ images that get displayed on internal or external facing content sites\n\nThe list could go on but I think these communicate the risk of an internal threat that has access to this information 😆 \n\n### PoC\n1. Set `LOG_STYLE=\"raw\"` and run Directus v9.23.1\n1. Log in to the application\n1. Look at the shell output and see that `directus_refresh_token` is logged\n    \u003e Note: This is different from the standard `raw` output format. I intentionally ran this with `npx directus start | pino-pretty` so logs would be easier to read. It can also be reproduced by running `npx directus start` alone. \n\n    ![image](https://user-images.githubusercontent.com/13325146/224877190-54e12d7e-3c3e-42d3-9e21-0bd4439f4f44.png)\n\n1. Exchange the `directus_refresh_token` for an `access_token`\n\n     ``` shell\n      curl -X POST \\\n        'http://0.0.0.0:8055/auth/refresh' \\\n        --header 'Accept: */*' \\\n        --header 'Cookie: directus_refresh_token=$shh'\n     ```\n\n### Impact\nBecause this can be used to exploit other threats related to  [CWE-284: Improper Access Control](https://cwe.mitre.org/data/definitions/284.html) I rank it with a Moderate severity. An insider with knowledge of this could do many mischievous things and get away with them for a long time without victims knowing about it. \n","status":"published","published":"2023-03-23T19:47:12Z","modified":"2023-03-24T13:32:10Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-532"],"updated_at":"2026-11-02T14:36:48.905887Z"}],"nvd":[{"id":"CVE-2023-28443","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.","status":"published","published":"2023-03-24T00:15:15.553Z","modified":"2026-06-17T05:47:45.007Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284","CWE-532"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"CVE-2023-28443","title":"directus vulnerable to Insertion of Sensitive Information into Log File","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.","status":"published","published":"2023-03-23T23:13:58.299Z","modified":"2026-10-28T02:30:49.983331207Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-532"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-8vg2-wf3q-mwv7","title":"directus vulnerable to Insertion of Sensitive Information into Log File","description":"### Summary\n\nCWE-532: Insertion of Sensitive Information into Log File discovered in v9.23.1. The `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. \n\n### Details\n\nUsing `v9.23.1`, I am seeing that the `directus_refresh_token` is not properly redacted as indicated by https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13\n\nI'm classifying this as a security vulnerability because if someone has access to the log outputs, for example with a shared Cloud account or Splunk implementation, they could exchange the refresh token using `/auth/refresh` for an access token and use the token to perform actions on behalf of an unsuspecting user. This situation creates issues with accountability and non-repudiation because we can no longer have confidence that actions taken in the application were authorized or even performed by the logged-in user. \n\nA couple of examples of this are:\n- A disgruntled employee deletes all of the data to get even with a target team member before logging off on their last day\n- Under the guise of their unsuspecting boss, a mischievous engineer uploads _questionable_ images that get displayed on internal or external facing content sites\n\nThe list could go on but I think these communicate the risk of an internal threat that has access to this information 😆 \n\n### PoC\n1. Set `LOG_STYLE=\"raw\"` and run Directus v9.23.1\n1. Log in to the application\n1. Look at the shell output and see that `directus_refresh_token` is logged\n    \u003e Note: This is different from the standard `raw` output format. I intentionally ran this with `npx directus start | pino-pretty` so logs would be easier to read. It can also be reproduced by running `npx directus start` alone. \n\n    ![image](https://user-images.githubusercontent.com/13325146/224877190-54e12d7e-3c3e-42d3-9e21-0bd4439f4f44.png)\n\n1. Exchange the `directus_refresh_token` for an `access_token`\n\n     ``` shell\n      curl -X POST \\\n        'http://0.0.0.0:8055/auth/refresh' \\\n        --header 'Accept: */*' \\\n        --header 'Cookie: directus_refresh_token=$shh'\n     ```\n\n### Impact\nBecause this can be used to exploit other threats related to  [CWE-284: Improper Access Control](https://cwe.mitre.org/data/definitions/284.html) I rank it with a Moderate severity. An insider with knowledge of this could do many mischievous things and get away with them for a long time without victims knowing about it. \n","status":"published","published":"2023-03-23T19:47:12Z","modified":"2023-11-08T04:12:11.139205Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-532"],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}