CVE-2024-55636: Drupal Core PHP Object Injection Vulnerability
Summary
CVE-2024-55636: Drupal core contains a potential PHP Object Injection vulnerability. Affects drupal/core across 3 version ranges.
>= 8.8.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fixed in 10.2.11, 10.3.9 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2024-55636 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely used open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and extensive community support. However, like any software, it is susceptible to vulnerabilities. The specific issue at hand is a potential PHP Object Injection vulnerability in Drupal Core, which could lead to arbitrary file deletion if combined with another exploit. This vulnerability affects multiple versions of Drupal Core, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
Vulnerability Detail
Drupal core contains a potential PHP Object Injection vulnerability that, if combined with another exploit, could lead to arbitrary file deletion. This vulnerability is not directly exploitable on its own. It requires a separate vulnerability that allows an attacker to pass unsafe input to the unserialize() function. Currently, there are no known exploits in Drupal core that would allow this to happen. To mitigate this issue, types have been added to properties in some of Drupal core's classes, and if an application extends those classes, the same types must be specified on the subclass to prevent a TypeError.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 10.2.1110.2.11composer require drupal/core:10.2.11 -
>= 10.3.0, < 10.3.910.3.9composer require drupal/core:10.3.9 -
>= 11.0.0, < 11.0.811.0.8composer require drupal/core:11.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, ensuring that your application does not pass unsafe input to the unserialize() function can help mitigate potential risks.
Conclusion
In summary, CVE-2024-55636 is a significant vulnerability in Drupal Core that could potentially lead to arbitrary file deletion if exploited alongside another vulnerability. It is essential for users of affected Drupal versions to update to the latest patched versions to secure their applications against this risk.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2024-55636 is a vulnerability in Drupal Core that involves a potential PHP Object Injection, which could lead to arbitrary file deletion if exploited in conjunction with another vulnerability.
The vulnerability affects Drupal Core versions from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application without any signup at the Vulert playground: Vulert Scanner.
While there are no specific workarounds, it is crucial to ensure that your application does not pass unsafe input to the unserialize() function to mitigate risks until you can update.
The CVSS score for this vulnerability is 9.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
