CVE-2024-55637: Drupal Gadget Chain Vulnerability Leading to Potential Remote Code Execution
Summary
CVE-2024-55637: Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007. Affects drupal across 2 version ranges.
>= 8.0.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fixed in 10.3.9 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2024-55637 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that allows users to build and manage websites easily. It is known for its flexibility, scalability, and a large ecosystem of modules and themes. However, like any software, Drupal is susceptible to vulnerabilities that can compromise its security. The specific vulnerability in question is related to the deserialization of untrusted data, which can lead to object injection and potentially remote code execution if exploited.
Vulnerability Detail
The vulnerability arises from a chain of methods within Drupal Core that can be exploited when an insecure deserialization vulnerability exists on the site. This gadget chain itself does not pose a direct threat, but it serves as a vector that can be leveraged to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The affected versions of Drupal Core are from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.3.910.3.9 -
>= 11.0.0, < 11.0.811.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the exposure of your application by ensuring that untrusted data is not deserialized. This can be achieved by implementing strict input validation and sanitization measures in your application code.
Conclusion
CVE-2024-55637 is a moderately critical vulnerability in Drupal Core that can lead to remote code execution through a gadget chain exploiting insecure deserialization. It is crucial to update to the latest patched versions to safeguard your application. Additionally, employing strict validation measures can help mitigate risks until an update can be performed.
See every vulnerability recorded for drupal →
FAQ
The impact of this vulnerability can lead to remote code execution if an attacker is able to exploit the insecure deserialization of untrusted data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected versions are Drupal Core from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
Yes, patches are available in the updated versions of Drupal Core: 10.3.9 and 11.0.8.
If you cannot update immediately, implement strict input validation and sanitization to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
