CVE-2024-55637: Drupal Core PHP Object Injection Vulnerability
Summary
CVE-2024-55637: Drupal core contains a potential PHP Object Injection vulnerability. Affects drupal/core across 3 version ranges.
>= 8.8.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fixed in 10.2.11, 10.3.9 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2024-55637 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely used open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and extensive community support. The core of Drupal is built on PHP, which enables dynamic content generation and user interaction. However, like any software, Drupal is susceptible to vulnerabilities that can compromise its security and functionality. This specific vulnerability relates to the handling of PHP objects, which, if exploited in conjunction with other vulnerabilities, could lead to severe consequences, including remote code execution.
Vulnerability Detail
Drupal core contains a potential PHP Object Injection vulnerability that could lead to Remote Code Execution if combined with another exploit. This vulnerability arises from the use of the unserialize() function, which can be manipulated if an attacker can pass unsafe input to it. While this issue is not directly exploitable on its own, it poses a significant risk when paired with other vulnerabilities. The affected versions of Drupal core include those from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8. The severity of this vulnerability is rated high, with a CVSS score of 9.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 10.2.1110.2.11composer require drupal/core:10.2.11 -
>= 10.3.0, < 10.3.910.3.9composer require drupal/core:10.3.9 -
>= 11.0.0, < 11.0.811.0.8composer require drupal/core:11.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not allow user input to be passed directly to the unserialize() function. Implement strict validation and sanitization of any data that could potentially be unserialized.
Conclusion
The PHP Object Injection vulnerability in Drupal core (CVE-2024-55637) poses a significant risk, particularly when combined with other exploits. It is crucial for users to update their Drupal installations to the latest patched versions to mitigate this risk. Additionally, implementing strict input validation can help protect against potential exploitation until updates can be applied.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2024-55637 is a vulnerability in Drupal core that allows for potential PHP Object Injection, which could lead to Remote Code Execution if exploited alongside another vulnerability.
The affected versions include Drupal core from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
If immediate updates are not possible, ensure that user inputs are validated and sanitized before being passed to any unserialization functions as a temporary measure.
The CVSS score of this vulnerability is 9.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
