Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

Vulnerability

Overview

CVE-2024-11942 is a file manipulation vulnerability in Drupal Core affecting versions 10.0.0 through 10.2.9. The flaw resides in the CKEditor 5 module, where a bug in image upload handling can, under certain uncommon site configurations, cause the entire webroot to be moved to a different location on the file system [3]. This is not a typical file upload bypass but a logic error that triggers a destructive filesystem operation.

Exploitation

Conditions

Exploitation requires several non-default site configurations to be present simultaneously, making the attack surface narrow. A malicious user with the ability to upload images via CKEditor 5 (typically an authenticated user with appropriate permissions) could trigger the bug. The advisory notes that the issue is mitigated by the rarity of the required configuration combination [3].

Impact

If successfully exploited, an attacker can move the entire webroot directory, effectively taking the site offline. This results in a denial-of-service condition, as the site's files are relocated and no longer accessible from their expected paths. No data theft or code execution is described, but the availability impact is severe.

Mitigation

Drupal 10.2.10 contains the fix for this issue. Sites running Drupal 10.2.x should update immediately. Drupal 10.3 and later are not affected, nor is Drupal 7. Versions prior to 10.2 are end-of-life and no longer receive security coverage, so upgrading to a supported release is strongly recommended [3].