Drupal core - Highly critical - Remote Code Execution
Affects Drupal 8.5.x before 8.5.11 and 8.6.x before 8.6.10 on sites with a web services module enabled, such as the core rest module allowing PATCH or POST. Fixed in 8.5.11 and 8.6.10.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 8.5.11, 8.6.10, 7.62.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Drupal core, the open-source content management system, is affected, along with sites that use its RESTful web services modules (such as REST, JSON:API, or Services). The flaw can allow an attacker to run arbitrary PHP code on the server, potentially giving them full control of the affected website.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Drupal Drupal Core
From 8.5 · fixed in 8.5.11; From 8.6 · fixed in 8.6.10
- drupal/corePackagist
From 8.0.0 · fixed in 8.5.11; From 8.6.0 · fixed in 8.6.10
- drupal/corePackagist
From 8.6.0 · fixed in 8.6.10
- drupal/corePackagist
From 7.0.0 · fixed in 7.62.0
- drupal/corePackagist
From 8.0.0 · fixed in 8.5.11
- drupal/drupalPackagist
From 7.0.0 · fixed in 7.62.0
- drupal/drupalPackagist
From 8.0.0 · fixed in 8.5.11
- drupal/drupalPackagist
From 8.6.0 · fixed in 8.6.10
References 6
synology.com
drupal.org
securityfocus.com
Questions about CVE-2019-6340
What does this mean?
The bug can lead to arbitrary PHP code execution on the site in some cases. It involves web services modules that accept PATCH or POST requests.Source: synology.com, drupal.org
Am I affected, and how do I check?
Drupal 8.5.x before 8.5.11 and 8.6.x before 8.6.10 are affected, as are Drupal 7 versions before 7.62.0 when Services or RESTful Web Services is enabled. The bug needs a web services module enabled, such as the core rest module allowing PATCH or POST or JSON:API in Drupal 8. You can check your version on the Drupal status report and review enabled modules on the Extend page.Source: synology.com, drupal.org
What should I do about it?
If you are on Drupal 8.6.x, upgrade to Drupal 8.6.10. Drupal 8.5.x sites should move to 8.5.11, and Drupal 7 sites to 7.62.0.Source: synology.com, drupal.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-25, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data