CVE-2024-13264
Published: 09 January 2025
Summary
CVE-2024-13264 is a critical-severity Static Code Injection (CWE-96) vulnerability in Opigno Opigno Module. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely patching of the vulnerable Opigno module to version 3.1.2 or later as specified in the Drupal security advisory.
Prevents static code injection by enforcing validation and neutralization of directives in user inputs before they are saved and executed as code in the Drupal module.
Detects unauthorized code modifications or injections resulting from the PHP Local File Inclusion vulnerability through software integrity monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in Drupal Opigno module enables arbitrary PHP code execution via insufficient uploaded file validation, facilitating exploitation of public-facing web applications and deployment/execution of web shells.
NVD Description
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
Deeper analysisAI
CVE-2024-13264 is an Improper Neutralization of Directives in Statically Saved Code vulnerability, classified as Static Code Injection (CWE-96), in the Drupal Opigno module. This flaw enables PHP Local File Inclusion and affects all versions of the Opigno module from 0.0.0 before 3.1.2.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Remote attackers with no authentication or privileges required can exploit it over the network with low attack complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability through PHP Local File Inclusion, potentially leading to arbitrary code execution.
The Drupal Security Advisory SA-CONTRIB-2024-028 at https://www.drupal.org/sa-contrib-2024-028 provides details on mitigation, including patching to Opigno module version 3.1.2 or later.
Details
- CWE(s)