CVE-2024-55638: Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
Other sources
Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
To help protect against this potential vulnerability, some additional checks have been added to Drupal core's database code. If you use a third-party database driver, check the release notes for additional configuration steps that may be required in certain cases.
This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55638?
CVE-2024-55638 has been classified as a critical vulnerability due to its potential for object injection and remote code execution.
How do I fix CVE-2024-55638?
To fix CVE-2024-55638, update your Drupal installation to version 7.102, 10.2.11, or 10.3.9, depending on the version you are currently using.
Which Drupal versions are affected by CVE-2024-55638?
CVE-2024-55638 affects Drupal Core versions from 7.0 before 7.102, from 8.0.0 before 10.2.11, and from 10.3.0 before 10.3.9.
What types of attacks can exploit CVE-2024-55638?
CVE-2024-55638 can be exploited through deserialization of untrusted data, leading to object injection vulnerabilities.
Is there a workaround for CVE-2024-55638?
There are no specific workarounds for CVE-2024-55638; the recommended action is to update to the patched versions.