Drupal has released a security advisory to address a critical remote code execution vulnerability (CVE-2019-6340).
Background
On February 20, Drupal released a security advisory (SA-CORE-2019-003) for CVE-2019-6340, a remote code execution vulnerability in its software. This vulnerability has received a security risk rating of Highly Critical as defined by Drupal.
Analysis
According to the security advisory, arbitrary PHP code execution is possible due to a lack of data sanitization in certain field types linked to non-form sources. However, specific site configurations are affected by this vulnerability.
Affected Configurations
- Drupal 8: Sites that use JSON:API or RESTful Web Services (with PATCH or POST requests enabled)
- Drupal 7: Sites that use RESTful Web Services or the Services module
The vulnerability was discovered by the Drupal Security Team, so it does not appear that this vulnerability has been exploited in the wild at this time.
Solution
Drupal recommends disabling all web services modules or disabling certain request types (PUT/PATCH/POST) server side to mitigate this vulnerability until patches can be applied.
Drupal has released Drupal 8.6.10 and Drupal 8.5.11 to address this vulnerability. There is no core update for Drupal 7. However, there are security updates for contributed modules for Drupal 7 and Drupal 8. Some of the updated modules include:
Identifying affected systems
A list of Nessus plugins to identify this vulnerability will appear here as they’re released.
Get more information
- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2019-003
- Drupal: Security risk levels defined
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 60-day trial of Tenable.io Vulnerability Management.