Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

Vulnerability

Overview

CVE-2024-11941 describes a denial-of-service (DoS) vulnerability in Drupal Core caused by excessive resource allocation. The issue specifically resides in the Comment module, where users can reply to comments. Under certain conditions, an attacker can make crafted comment reply requests that lead to unbounded memory or processing consumption, resulting in a denial of service [3].

Attack

Vector and Prerequisites

The vulnerability is exploitable over the network without authentication, as the Comment module is commonly enabled and accessible to anonymous users. An attacker does not need any special privileges; they only need the ability to submit comment reply requests. The attack does not require user interaction beyond the initial request [2][3].

Impact

If successfully exploited, an attacker can cause the Drupal site to become unresponsive due to excessive resource allocation. This effectively denies service to legitimate users. The impact is limited to availability; there is no evidence of data integrity or confidentiality compromise [2][3].

Mitigation

Status

The Drupal Security Team has released patches for the affected versions. Users running Drupal 10.2.x prior to 10.2.2 must update to 10.2.2, and those on 10.1.x prior to 10.1.8 must update to 10.1.8. Versions of Drupal 10 before 10.1 are end-of-life and do not receive security updates. Sites that do not use the Comment module are not affected [3].