CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability
Summary
CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability. Affects drupal/core across 3 version ranges.
>= 7.0.0, < 7.62.0
>= 8.0.0, < 8.5.11
>= 8.6.0, < 8.6.10
Fixed in 7.62.0, 8.5.11 or 8.6.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The Drupal core package is the foundation of the CMS and includes essential functionality. This vulnerability affects Drupal core versions 7.0.0 to 7.62.0 and 8.0.0 to 8.5.11, as well as 8.6.0 to 8.6.10. The vulnerability allows for remote code execution, potentially leading to arbitrary PHP code execution. It primarily affects sites that have the Drupal 8 core RESTful Web Services (rest) module enabled and allow PATCH or POST requests, or have other web services modules enabled, such as JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7.
Vulnerability Detail
The vulnerability arises from a lack of proper data sanitization in certain field types in Drupal. This allows an attacker to inject malicious PHP code, which can be executed under certain conditions. The vulnerability can be exploited through the Drupal core RESTful Web Services module or other web services modules. An attacker with the ability to send crafted requests to the affected site can execute arbitrary PHP code, potentially gaining unauthorized access, modifying data, or causing other malicious actions. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.62.07.62.0composer require drupal/core:7.62.0 -
>= 8.0.0, < 8.5.118.5.11composer require drupal/core:8.5.11 -
>= 8.6.0, < 8.6.108.6.10composer require drupal/core:8.6.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to disable the affected web services modules. For Drupal 8, disable the RESTful Web Services (rest) module or any other web services modules in use. For Drupal 7, disable the Services or RESTful Web Services module. Disabling these modules will prevent the exploitation of the vulnerability, but it may impact the functionality of the affected site.
Conclusion
The Drupal Core Remote Code Execution Vulnerability (CVE-2019-6340) is a critical security issue that allows for arbitrary PHP code execution. It primarily affects Drupal sites with the core RESTful Web Services module enabled or other web services modules. To mitigate the vulnerability, it is essential to update Drupal core to the latest version available and review any contributed modules for updates. If immediate updating is not possible, disabling the affected web services modules can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your Drupal site is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this Drupal core vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the necessary updates and security patches promptly to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can send crafted requests to the affected site, potentially leading to arbitrary PHP code execution.
There have been reports of active exploitation of this vulnerability in the wild. It is highly recommended to apply the necessary updates and security patches as soon as possible to protect your Drupal site.
If immediate updating is not possible, it is recommended to disable the affected web services modules, such as RESTful Web Services or Services, to prevent the exploitation of the vulnerability. However, updating to the latest version of Drupal core is the most effective long-term solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
