CVE-2024-12393: Drupal Core XSS Vulnerability

CVE-2024-12393 Overview

CVE-2024-12393 is a Cross-Site Scripting (XSS) vulnerability in Drupal Core caused by improper neutralization of input during web page generation [CWE-79]. The flaw affects multiple Drupal Core release branches and allows authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. Successful exploitation requires user interaction and low privileges, but the scope change means the impact can extend beyond the vulnerable component. Drupal addressed the issue in security advisory SA-CORE-2024-003.

Critical Impact
Authenticated attackers can inject scripts that execute in victim browsers, enabling session theft, content defacement, and account compromise across Drupal-managed sites.

Affected Products

Drupal Core 8.8.0 through versions before 10.2.11
Drupal Core 10.3.0 through versions before 10.3.9
Drupal Core 11.0.0 through versions before 11.0.8

Discovery Timeline

2024-12-10 - CVE-2024-12393 published to NVD
2025-06-02 - Last updated in NVD database

Technical Details for CVE-2024-12393

Vulnerability Analysis

The vulnerability resides in Drupal Core's handling of user-supplied input during web page generation. Drupal fails to properly neutralize special characters before reflecting them into rendered HTML output. An authenticated attacker with low-privilege access can craft input containing JavaScript payloads that the application stores or reflects without adequate sanitization. When a victim loads the affected page, the malicious script executes in their browser session under the trust context of the Drupal site.

The scope-changed nature of this flaw means injected scripts can affect resources beyond the immediately vulnerable component. This includes administrative interfaces, authenticated user sessions, and any browser-accessible data within the same origin. Common attack outcomes include session token theft, forced administrative actions through CSRF chaining, and credential harvesting via injected forms.

Root Cause

The root cause is insufficient output encoding in one or more Drupal Core subsystems that process user-controlled data. Drupal's render pipeline normally applies context-aware escaping through Twig auto-escaping and the Html::escape() helper, but specific code paths in affected versions bypass or incorrectly apply these protections. The Drupal Security Team classified this issue as moderately critical, consistent with its requirement for authenticated access and user interaction.

Attack Vector

Exploitation requires network access to the Drupal site and a valid user account with sufficient privileges to submit content or configuration containing the malicious payload. The attacker stores or reflects crafted input that bypasses Drupal's sanitization, then waits for or directs a victim to view the affected page. User interaction is required, typically clicking a link or loading content where the payload renders. No verified proof-of-concept exploit is publicly available at the time of this writing.

The vulnerability mechanism is described in the Drupal Security Advisory SA-CORE-2024-003. Site operators should reference the advisory for the specific affected subsystems and code paths.

Detection Methods for CVE-2024-12393

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload, onclick), or javascript: URIs appearing in stored Drupal content, node fields, or configuration entities
Outbound requests from user browsers to attacker-controlled domains shortly after rendering Drupal pages
Administrative account actions originating from unusual IP addresses or user agents following content views

Detection Strategies

Audit Drupal database tables and field storage for HTML payloads containing script tags or encoded JavaScript in fields not expected to contain markup
Inspect web server access logs for requests containing reflected XSS patterns in query parameters, POST bodies, or referrer headers
Enable Content Security Policy (CSP) reporting to capture script execution attempts that violate site policy

Monitoring Recommendations

Monitor Drupal watchdog logs and reverse proxy logs for anomalous content submissions from low-privilege accounts
Alert on creation or modification of nodes, blocks, or taxonomy terms containing HTML event handlers or <script> elements by non-administrative users
Track session anomalies such as concurrent logins from different geolocations following content rendering events

How to Mitigate CVE-2024-12393

Immediate Actions Required

Upgrade Drupal Core to 10.2.11, 10.3.9, 11.0.8, or later according to your current release branch
Audit user-submitted content created before patching for stored XSS payloads and remove malicious entries
Review and rotate session tokens and administrative credentials if compromise is suspected

Patch Information

Drupal released fixed versions on the advisory date documented in Drupal Security Advisory SA-CORE-2024-003. Apply Drupal Core 10.2.11 for the 10.2.x branch, 10.3.9 for the 10.3.x branch, and 11.0.8 for the 11.0.x branch. Drupal versions earlier than 10.2 are end-of-life and require migration to a supported branch.

Workarounds

Restrict content creation and configuration permissions to trusted users only until patching is complete
Deploy a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins
Place a web application firewall (WAF) in front of Drupal to filter common XSS payload patterns in request bodies and parameters

bash

# Update Drupal Core using Composer to a patched version
composer require drupal/core-recommended:^10.3.9 --update-with-dependencies
composer require drupal/core-composer-scaffold:^10.3.9 --update-with-dependencies

# Apply database updates after upgrade
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild