Drupal up to 8.5.10/8.6.9 RESTful Web Services POST Request deserialization

Summaryinfo

A vulnerability identified as critical has been detected in Drupal up to 8.5.10/8.6.9. This issue affects some unknown processing of the component RESTful Web Services. Performing a manipulation as part of POST Request results in input validation. This vulnerability is identified as CVE-2019-6340. The attack can be initiated remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Drupal up to 8.5.10/8.6.9 (Content Management System). It has been classified as critical. This affects some unknown functionality of the component RESTful Web Services. The manipulation as part of a POST Request leads to a input validation vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

The bug was discovered 02/20/2019. The weakness was released 02/21/2019 (Website). It is possible to read the advisory at drupal.org. This vulnerability is uniquely identified as CVE-2019-6340 since 01/15/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available.

After 2 weeks, there has been an exploit disclosed. The exploit is shared for download at exploit-db.com. It is declared as attacked. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 150235 (Drupal RCE Vulnerability (SA-CORE-2019-003)). The CISA Known Exploited Vulnerabilities Catalog lists this issue since 03/25/2022 with a due date of 04/15/2022:

Apply updates per vendor instructions.

Upgrading to version 8.5.11 or 8.6.10 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (46510). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Drupal

Version

• 8.5.0
• 8.5.1
• 8.5.2
• 8.5.3
• 8.5.4
• 8.5.5
• 8.5.6
• 8.5.7
• 8.5.8
• 8.5.9
• 8.5.10
• 8.6.0
• 8.6.1
• 8.6.2
• 8.6.3
• 8.6.4
• 8.6.5
• 8.6.6
• 8.6.7
• 8.6.8
• 8.6.9

License

• open-source

Website

• Product: https://www.drupal.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion