CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
Description
CVE-2019-6340 is a critical remote code execution vulnerability in Drupal Core that can be exploited through the RESTful Web Services module. The flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by sending specially crafted requests to REST endpoints. Drupal is one of the most widely deployed content management systems, making this vulnerability particularly impactful. It was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, and with an EPSS score of 97.3% (99.9th percentile), exploitation is near-certain for unpatched Drupal installations with REST enabled.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| drupal | drupal | >= 8.5.0, < 8.5.11; >= 8.6.0, < 8.6.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/107106(Broken Link, Third Party Advisory, VDB Entry)
- https://www.drupal.org/sa-core-2019-003(Mitigation, Vendor Advisory)
- https://www.exploit-db.com/exploits/46452/(Patch, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46459/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46510/(Exploit, Third Party Advisory)
- https://www.synology.com/security/advisory/Synology_SA_19_09(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2019-6340 is classified under CWE-94, which describes vulnerabilities where an application does not properly neutralize code syntax in user-controlled input, allowing an attacker to inject and execute arbitrary code. Drupal's RESTful Web Services module fails to properly sanitize deserialized data from incoming requests, enabling remote code execution through crafted payloads.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2019-6340 allows unauthenticated remote attackers to achieve full code execution on Drupal web servers, resulting in complete compromise of the web application and potentially the underlying server. The attacker gains the ability to read, modify, or delete all content and user data within the Drupal database, execute operating system commands with the web server's privileges, install backdoors or web shells for persistent access, and pivot to other systems on the internal network. The vulnerability requires no authentication and can be exploited with low complexity via network-accessible HTTP requests, making any internet-facing Drupal site with RESTful Web Services enabled an immediate target.
Exploit Maturity
CVE-2019-6340 has been confirmed as actively exploited in the wild by CISA. Multiple public exploit tools and proof-of-concept scripts are available, including integration into popular penetration testing frameworks. The vulnerability's straightforward exploitation via HTTP requests and the widespread deployment of Drupal make it a frequent target for automated scanning and exploitation campaigns. With an EPSS score of 97.3% (99.9th percentile), exploitation is near-certain for any vulnerable, exposed Drupal instance.
Remediation
- Update Drupal Core immediately: Upgrade to Drupal 8.6.10 or 8.5.11 or later, which contain the security fix for CVE-2019-6340.
- Disable unused REST resources: If RESTful Web Services, JSON:API, or other web services modules are not needed, disable them to eliminate the attack surface entirely.
- Restrict REST endpoint access: If REST services are required, configure them to require authentication and restrict access to specific, trusted IP addresses or networks.
- Monitor for exploitation indicators: Review web server access logs for suspicious POST or PATCH requests to REST endpoints, particularly those containing serialized PHP objects or unusual Content-Type headers.
- Conduct a forensic review: If the site was exposed prior to patching, perform a thorough investigation for web shells, modified files, or unauthorized database changes that may indicate prior compromise.
Technical Details
CVE-2019-6340 exploits a deserialization flaw in Drupal Core's handling of incoming data through the RESTful Web Services module (rest) and related modules such as JSON:API. When Drupal receives requests with certain content types (such as HAL+JSON), the deserialization process does not adequately validate or sanitize the data before processing. An attacker can craft a malicious serialized payload that, when deserialized by Drupal, triggers arbitrary PHP code execution on the server. The vulnerability is exploitable via standard HTTP methods (GET, POST, PATCH) to any enabled REST resource, and no authentication is required if the REST resource is configured for anonymous access, which is a common default configuration.
Frequently Asked Questions
Is CVE-2019-6340 being actively exploited?
Yes. CISA confirmed active exploitation and added CVE-2019-6340 to the Known Exploited Vulnerabilities catalog. Multiple public exploit tools exist, and automated scanning for vulnerable Drupal installations is widespread. The EPSS score of 97.3% confirms near-certain exploitation.
What products are affected by CVE-2019-6340?
CVE-2019-6340 affects Drupal Core versions prior to 8.6.10 and 8.5.11 when the RESTful Web Services module or other web services modules (such as JSON:API) are enabled. Drupal 7 is not directly affected unless a similar contributed module is installed.
How do I fix CVE-2019-6340?
Upgrade Drupal Core to version 8.6.10, 8.5.11, or later. If immediate upgrading is not possible, disable the RESTful Web Services, JSON:API, and any other web services modules as a temporary mitigation.
How severe is CVE-2019-6340?
CVE-2019-6340 is a critical remote code execution vulnerability with an EPSS score of 97.3%. It allows unauthenticated attackers to execute arbitrary code on the server, potentially leading to complete site compromise, data theft, and server takeover.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.