PT-2019-18086 · Drupal · Drupal

Jasper Mattsson · Publicado 2019-02-21 · Atualizado 2025-11-07 · CVE-2019-6340

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal versions 8.5.x before 8.5.11 Drupal versions 8.6.x before 8.6.10

Description Some field types do not properly sanitize data from non-form sources in Drupal. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7.

Recommendations For Drupal 8.5.x, update to version 8.5.11 or later. For Drupal 8.6.x, update to version 8.6.10 or later. As a temporary workaround, consider disabling the RESTful Web Services (rest) module until a patch is available. Restrict access to the vulnerable module rest to minimize the risk of exploitation. Avoid using the PATCH or POST requests in the affected API endpoints until the issue is resolved.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-6340

DRUPAL-CORE-2019-003

GHSA-3GX6-H57H-RM27

Produtos afetados

Drupal

Referências · 29

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_restws_unserialize.rb · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-6340 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2019-6340 · Exploit
• 🔥 https://github.com/g0rx/Drupal-SA-CORE-2019-003 · Exploit
• 🔥 https://github.com/oways/CVE-2019-6340 · Exploit
• 🔥 https://github.com/DevDungeon/CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass · Exploit
• 🔥 https://github.com/ludy-dev/drupal8-REST-RCE · Exploit
• 🔥 https://exploit-db.com/exploits/46459 · Exploit
• 🔥 https://exploit-db.com/exploits/46452 · Exploit
• 🔥❌ https://github.com/Apasys/Apasys-CVE-2019-6340 · Exploit, Deleted
• 🔥❌ https://github.com/Nephael/Nephael-CVE-2019-6340 · Exploit, Deleted
• 🔥 https://packetstormsecurity.com/files/151992/Drupal-RESTful-Web-Services-unserialize-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/46510 · Exploit