PT-2019-18086 · Drupal · Drupal

Jasper Mattsson · Published 2019-02-21 · Updated 2025-11-07 · CVE-2019-6340

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal versions 8.5.x before 8.5.11 Drupal versions 8.6.x before 8.6.10

Description Some field types do not properly sanitize data from non-form sources in Drupal. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7.

Recommendations For Drupal 8.5.x, update to version 8.5.11 or later. For Drupal 8.6.x, update to version 8.6.10 or later. As a temporary workaround, consider disabling the RESTful Web Services (rest) module until a patch is available. Restrict access to the vulnerable module rest to minimize the risk of exploitation. Avoid using the PATCH or POST requests in the affected API endpoints until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-6340

DRUPAL-CORE-2019-003

GHSA-3GX6-H57H-RM27

Affected Products

Drupal

References · 29

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_restws_unserialize.rb · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-6340 · Exploit
• 🔥 https://github.com/knqyf263/CVE-2019-6340 · Exploit
• 🔥 https://github.com/g0rx/Drupal-SA-CORE-2019-003 · Exploit
• 🔥 https://github.com/oways/CVE-2019-6340 · Exploit
• 🔥 https://github.com/DevDungeon/CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass · Exploit
• 🔥 https://github.com/ludy-dev/drupal8-REST-RCE · Exploit
• 🔥 https://exploit-db.com/exploits/46459 · Exploit
• 🔥 https://exploit-db.com/exploits/46452 · Exploit
• 🔥❌ https://github.com/Apasys/Apasys-CVE-2019-6340 · Exploit, Deleted
• 🔥❌ https://github.com/Nephael/Nephael-CVE-2019-6340 · Exploit, Deleted
• 🔥 https://packetstormsecurity.com/files/151992/Drupal-RESTful-Web-Services-unserialize-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/46510 · Exploit