CVE-2019-6340
Published: 21 February 2019
Summary
CVE-2019-6340 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Drupal Drupal. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2019-6340 is a deserialization flaw (CWE-502) in certain Drupal field types that fail to sanitize input originating from non-form sources. It affects Drupal 8.5.x releases prior to 8.5.11 and 8.6.x releases prior to 8.6.10. A site is vulnerable only when the core RESTful Web Services module is enabled and configured to accept PATCH or POST requests, or when an alternative web-services module such as JSON:API is present.
An unauthenticated remote attacker who can reach an exposed web-services endpoint can supply a crafted payload that triggers arbitrary PHP code execution. The attack requires a complex set of conditions (CVSS AC:H) but needs no user interaction or credentials, resulting in full confidentiality, integrity, and availability impact.
The Drupal security advisory SA-CORE-2019-003 recommends immediate upgrade to the fixed releases and states that sites not using the affected modules are not at risk. Public exploit code for the vulnerability has been published on Exploit-DB.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-2184
Vulnerability details
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if…
more
one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
- CWE(s)
- KEV Date Added
- 25 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all input (including non-form REST/JSON:API payloads) before deserialization or processing, blocking the CWE-502 vector.
Enforces disabling or restricting non-essential modules (rest, JSON:API) so the vulnerable code path is never exposed.
Enforces access-control decisions on PATCH/POST requests to web-service endpoints, limiting unauthenticated exploitation even when the modules remain enabled.