CVE-2024-55638

Drupal Core contains a chain of methods (a so-called gadget chain) which in itself does not pose a direct threat, but becomes an attack vector when the application deserializes untrusted data due to another vulnerability on the website. An attacker can exploit this gadget chain to execute arbitrary code on the server (Object Injection leading to RCE). The mechanism is based on manipulating serialized PHP objects which — after deserialization — invoke a dangerous chain of methods built into the Drupal core.

An attacker can gain full control of the server — including reading and modifying data, installing backdoors, and taking over the system — if another vulnerability exists on the website that allows deserialization of untrusted data.

Drupal Core must be updated to version 7.102, 10.2.11, or 10.3.9 depending on the branch being used. Detailed information is available in the vendor's advisory: https://www.drupal.org/sa-core-2024-008

Drupal Core in versions from 7.0 before 7.102, from 8.0.0 before 10.2.11, and from 10.3.0 before 10.3.9.