Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

Vulnerability

Overview

CVE-2024-55638 is a deserialization of untrusted data vulnerability in Drupal core that leads to PHP object injection. The core software includes a chain of methods (a "gadget chain") that can be exploited when an insecure deserialization vulnerability exists on the site [1][2]. This chain itself is not directly exploitable but provides a vector for remote code execution if the application deserializes untrusted data from another source [3].

Exploitation

Conditions

The vulnerability is mitigated by the requirement that an attacker must first exploit a separate flaw to pass malicious input to the unserialize() function [3]. There are no known such exploits in Drupal core, making this a chained vulnerability that depends on another weakness. Affected versions include Drupal 7.0 before 7.102, 8.0.0 before 10.2.11, and 10.3.0 before 10.3.9 [1][2].

Impact

If successfully exploited in combination with another vulnerability, an attacker could achieve remote code execution on the affected server. The gadget chain provides the required execution payload, turning a simple deserialization bug into a critical security breach [2][3].

Mitigation

Drupal has released patches in versions 7.102, 10.2.11, and 10.3.9. Users should update immediately. Versions of Drupal 10 prior to 10.2 are end-of-life and no longer receive security coverage; Drupal 8 and 9 are also end-of-life [3]. Site administrators using third-party database drivers should review the release notes for potential additional configuration steps [3].