Code Injection in Drupal - CVE-2019-6340

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to improper input validation when processing field types in requests, related to API functionality. A remote attacker can send a specially crafted request and execute arbitrary PHP code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that:

• - RESTful Web Services (rest) module is enabled and accepts PATCH or POST requests

OR


• - the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7.

Affected software

How to mitigate CVE-2019-6340

Links to Public Exploits and PoC-codes

• Exploit #5948 - Drupal < 8.6.9 - REST Module Remote Code Execution (June 17, 2021)
• Exploit #5337 - CVE-2019-6340 (Drupal Drupal 8.6.x RCE Exploit) (May 3, 2021)
• Exploit #2291 - Exploits (Containing Self Made Perl Reproducers / PoC Codes) (April 7, 2020)
• Exploit #1993 - Alien-Framework (Alien-Framework, it is a framework with many CVE exploits and tools to use in pen-testing.) (March 18, 2020)
• Exploit #1534 - Drupal RESTful Web Services unserialize() RCE (March 18, 2020)

External References

• https://www.drupal.org/sa-core-2019-003

Related Security Bulletins

• Remote PHP code execution in Drupal
• Debian update for drupal7