Drupal core enthält eine potentielle PHP Object Injection Vulnerabilität

The primary impact of CVE-2024-55636 lies in the potential for arbitrary file deletion. An attacker, possessing a separate vulnerability to inject malicious data into the unserialize() function, could leverage this object injection to target and delete critical system files or user data. The blast radius is dependent on the attacker's ability to exploit the prerequisite vulnerability and the permissions of the Drupal process. While no direct exploit exists within Drupal core, the possibility of chaining this vulnerability with others presents a significant risk, particularly in environments with complex configurations or third-party modules.

Organizations running Drupal Core versions 9.5.9 and earlier, particularly those with complex module configurations or custom code that might introduce vulnerabilities allowing input to unserialize(), are at risk. Shared hosting environments utilizing Drupal Core are also potentially vulnerable due to the shared nature of the infrastructure.

1. 2024-12-10Disclosure

   disclosure

1. Reserviert2024-12-09
2. Veröffentlicht2024-12-10
3. Geändert2025-12-10
4. EPSS aktualisiert2026-04-02

The immediate mitigation for CVE-2024-55636 is to upgrade Drupal Core to version 10.2.11 or later. This version includes type declarations for properties in core classes, which helps prevent object injection. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization to prevent malicious data from reaching the unserialize() function. While a WAF or proxy cannot directly prevent this vulnerability, they can help detect and block attempts to exploit it by monitoring for suspicious unserialization patterns. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious payload (if available) and verifying that the file deletion is prevented.