Drupal core - Highly critical - Remote Code Execution

CVE-2019-6340

8.1HIGH

Key Information

Vendor: Drupal
Status: Drupal Core
Vendor: CVE Published:; 21 February 2019

Badges

👾 Exploit Exists🔴 Public PoC🟣 EPSS 97%

Summary

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2019-6340 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Drupal Core < 8.5.11

Drupal Core < 8.6.10

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-6340
Created by jas502n

CVE-2019-6340
Created by knqyf263

Drupal-SA-CORE-2019-003
Created by g0rx