Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

CVE-2024-55637 describes a deserialization gadget chain in Drupal core that, while not directly exploitable, can be used to achieve remote code execution if an attacker can trigger deserialization of untrusted data via a separate vulnerability [2]. The root cause is that certain classes in Drupal core contain properties that, when deserialized, can invoke a chain of methods leading to arbitrary code execution. The Drupal security advisory (SA-CORE-2024-007) notes that this is a potential PHP Object Injection vulnerability that requires another exploit to pass unsafe input to unserialize() [3].

The attack surface requires the presence of a separate vulnerability that allows an attacker to supply untrusted data to a deserialization call. No authentication is needed if such a vulnerability exists. The gadget chain itself is a vector that amplifies the impact of an insecure deserialization flaw. The fix, visible in the commit [4], adds type hints to properties such as $query in the ViewExecutable class, which prevents the gadget chain from being triggered during deserialization.

If successfully exploited, an attacker could achieve remote code execution on the affected Drupal site. However, the Drupal Security Team states that there are no known exploits in Drupal core that directly allow untrusted deserialization, and the issue is rated as moderately critical [3].

The vulnerability affects Drupal core versions from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8. Drupal 7 is not affected. Users are advised to update to the latest patched versions: 10.2.11, 10.3.9, or 11.0.8. Older versions (Drupal 8, 9, and 10 prior to 10.2) are end-of-life and no longer receive security coverage [3].