CVE-2025-53887: 
JavaScript vulnerability analysis and mitigation

CVE-2025-53887 is a version number disclosure vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The exact Directus version number was incorrectly used as the OpenAPI Specification version field, causing it to be exposed unauthenticated via the /server/specs/oas endpoint. The vulnerability affects Directus versions 9.0.0 through 11.8.x (prior to 11.9.0) and was published on July 14–15, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In the affected versions, the OASSpecsService in api/src/services/specifications.ts populated the info.version field of the OpenAPI spec object with the literal Directus version string (imported from directus/version) rather than a generic or obfuscated value. Because the /server/specs/oas endpoint requires no authentication, any unauthenticated network request to this endpoint returns the precise running version of Directus. The fix replaced the version string with a unique hashed value derived from the current timestamp and user context, preventing direct version fingerprinting (GitHub Advisory, Patch Commit).

The primary impact is limited to confidentiality — specifically, enabling an attacker to perform precise version fingerprinting of a Directus instance without any credentials. With the exact version number, an attacker can cross-reference known CVEs or dependency vulnerabilities applicable to that specific release, facilitating targeted follow-on attacks against Directus core or its shipped dependencies. There is no direct integrity or availability impact from this vulnerability itself (GitHub Advisory).

No public proof-of-concept exploit code exists, and there is no evidence of active in-the-wild exploitation as of the disclosure date. The vulnerability requires no authentication, no user interaction, and no special privileges — a simple unauthenticated HTTP GET request to /server/specs/oas is sufficient to retrieve the version information. The EPSS score is approximately 0.05% (per Feedly data) to 0.316% (per GitHub Advisory Database), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Directus instances using tools like Shodan or Censys by searching for known Directus UI or API response signatures.
2. Send unauthenticated request: Issue an HTTP GET request to the target's /server/specs/oas endpoint without any authentication headers: GET /server/specs/oas HTTP/1.1.
3. Extract version: Parse the JSON response and read the info.version field, which contains the exact Directus version string (e.g., "version": "11.5.2").
4. Cross-reference vulnerabilities: Query public vulnerability databases (NVD, GitHub Advisories, OSV) for known CVEs affecting that specific Directus version or its npm dependencies.
5. Plan targeted attack: Use the identified vulnerabilities to craft a more precise follow-on attack against the confirmed version (GitHub Advisory, Patch Commit).

• Network: Unauthenticated HTTP GET requests to /server/specs/oas from external or unexpected IP addresses, particularly in high volume or from scanning infrastructure.
• Logs: Web server or application access logs showing repeated requests to /server/specs/oas without authentication tokens or session cookies, especially from automated tools (e.g., unusual User-Agent strings associated with scanners like nuclei, curl, or python-requests).
• Logs: Requests to /server/specs/oas originating from IP ranges associated with known threat intelligence feeds or Tor exit nodes.

Upgrade Directus to version 11.9.0 or later, which replaces the exposed version string in the OpenAPI spec with a unique hashed value (Directus v11.9.0 Release). If an immediate upgrade is not feasible, implement network-level or WAF rules to restrict unauthenticated access to the /server/specs/oas endpoint, or ensure the endpoint is not publicly reachable. Regularly audit access logs for unexpected requests to this endpoint as an interim monitoring measure.

The vulnerability was discovered and reported by GitHub user br41nslug, who also authored the fix via pull request #25353. The advisory was published by the Directus team on July 14, 2025, and the fix was merged and released as part of v11.9.0 on June 25, 2025 (prior to public disclosure). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database aggregation (GitHub Advisory, Directus v11.9.0 Release).