Patchfirst
Patchfirst
CVE-2019-6340 KEVPublic exploit High · 8.1 EPSS 92.0%

Drupal Core Remote Code Execution Vulnerability

Drupal · Core

Summary

Drupal Core contains a flaw where some field types fail to properly sanitize data arriving from non-form sources in Drupal 8.5.x before 8.5.11 and 8.6.x before 8.6.10, enabling untrusted data deserialization. An unauthenticated remote attacker can, in some cases, execute arbitrary PHP code, but only on sites that have the core RESTful Web Services (rest) module enabled with PATCH or POST allowed, or another web services module such as JSON:API (or Services/RESTful Web Services on Drupal 7) enabled.

Official description · NVD

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Breakdown
68.6 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 10 months after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.

  1. Public exploit codeMetasploit1 day before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+10 mo
  4. Added to CISA KEVEU database agrees+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

web service endpoints accept untrusted remote requests

allows PATCH or POST requests
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

arbitrary PHP code execution from crafted input

can lead to arbitrary PHP code execution
From the official description (NVD) Original (opens in a new tab) ↗
Lower-confidence links (2)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploitation for Client ExecutionT1203 server-side bug exploitable without user interaction; client-execution technique does not fit
  • Spearphishing AttachmentT1566.001 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-6340 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: drupal/core.

Packagistdrupal/coreGHSA-3gx6-h57h-rm27DRUPAL-CORE-2019-003

Upgrade to 8.9.17

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2019-11358, CVE-2020-13671, +2).

Still affected on this line by CVE-2026-9082 (fixed in 10.4.10, a newer line).

Set the version to 8.9.17 or later in your composer.json.

First fixed in 8.6.10 for CVE-2019-6340.

Affected versions, by release line

If you runUpgrade to
8.6.0 up to 8.6.108.9.17first fix for this CVE: 8.6.10
8.0.0 up to 8.5.11

Still affected on this line by CVE-2020-13671 (fixed in 8.8.11, a newer line); CVE-2020-28949 (fixed in 8.8.12, a newer line); CVE-2021-32610 (fixed in 8.9.17, a newer line).

8.5.15first fix for this CVE: 8.5.11
7.0.0 up to 7.62.07.74first fix for this CVE: 7.62.0

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Packagistdrupal/drupal
    Affected: 8.6.0 up to 8.6.10; 8.0.0 up to 8.5.11; 7.0.0 up to 7.62.0Upgrade to 8.8.11 or later (older lines: 8.5.11, 7.74)
    GHSA-3gx6-h57h-rm27

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

7 links, grouped by NVD tag (6 duplicates merged)

Vendor Advisory 1

drupal.org/sa-core-2019-003

Patch 1

exploit-db.com/exploits/46452/

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340

Third Party Advisory 4

securityfocus.com/bid/107106exploit-db.com/exploits/46459/exploit-db.com/exploits/46510/synology.com/security/advisory/Synology_SA_19_09
↑ ↓ chooseEnter openEsc close