CVE-2024-55637: Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
Other sources
Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
To help protect against this potential vulnerability, types have been added to properties in some of Drupal core's classes. If an application extends those classes, the same types may need to be specified on the subclass to avoid a TypeError.
This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55637?
CVE-2024-55637 is considered a critical vulnerability due to its potential for remote code execution through object injection.
How do I fix CVE-2024-55637?
To fix CVE-2024-55637, you need to upgrade your Drupal Core to at least version 11.0.8, 10.3.9, or 10.2.11.
What versions of Drupal are affected by CVE-2024-55637?
CVE-2024-55637 affects Drupal Core versions from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
Can CVE-2024-55637 lead to data breaches?
Yes, CVE-2024-55637 can lead to data breaches as it allows attackers to execute arbitrary code through deserialization of untrusted data.
What should I do if I cannot immediately update for CVE-2024-55637?
If you cannot immediately update, ensure your site is behind a firewall and limit access to sensitive areas while monitoring for any suspicious activity.