CVE-2024-12393: Drupal Core XSS Vulnerability

CVE-2024-12393 Overview

CVE-2024-12393 is a Cross-Site Scripting (XSS) vulnerability in Drupal Core that stems from improper neutralization of input during web page generation. This vulnerability allows attackers with low privileges to inject malicious scripts that execute in the context of other users' browser sessions, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of victims.

Critical Impact

Authenticated attackers can exploit this XSS vulnerability to execute arbitrary JavaScript in victims' browsers, enabling session hijacking, data theft, and defacement of Drupal-powered websites.

Affected Products

• Drupal Core versions 8.8.0 through 10.2.10
• Drupal Core versions 10.3.0 through 10.3.8
• Drupal Core versions 11.0.0 through 11.0.7

Discovery Timeline

• 2024-12-10 - CVE-2024-12393 published to NVD
• 2025-06-02 - Last updated in NVD database

Technical Details for CVE-2024-12393

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists within Drupal Core's input handling mechanisms, where user-supplied data is not properly sanitized before being rendered in web pages.

The attack requires network access and low-level privileges within the Drupal application. When successfully exploited, the vulnerability can affect resources beyond the security scope of the vulnerable component, potentially impacting both the confidentiality and integrity of user data and sessions.

Root Cause

The root cause of CVE-2024-12393 lies in insufficient input validation and output encoding within Drupal Core's rendering pipeline. User-controlled data passes through the application without adequate sanitization, allowing specially crafted input containing JavaScript payloads to be embedded in dynamically generated HTML content. When this content is served to other users, the malicious scripts execute within their browser context.

Attack Vector

The attack vector for this vulnerability is network-based, requiring the attacker to have authenticated access to the Drupal application (low privileges required). The exploitation also requires user interaction—a victim must view or interact with the page containing the injected malicious payload.

An attacker would craft a payload containing JavaScript code designed to perform malicious actions such as stealing session cookies, capturing keystrokes, or redirecting users to phishing sites. Once the payload is stored in the Drupal application and rendered for other users, the malicious script executes in the victim's browser with their session privileges.

The vulnerability mechanism involves insufficient sanitization of user input in Drupal Core's web page generation process. For complete technical details on the affected components and exploitation vectors, refer to the Drupal Security Advisory SA-CORE-2024-003.

Detection Methods for CVE-2024-12393

Indicators of Compromise

• Unexpected JavaScript code present in user-generated content fields or database records
• Suspicious entries in web server access logs showing encoded script payloads in request parameters
• User reports of unusual browser behavior or unexpected redirects when accessing specific Drupal pages
• Session anomalies indicating potential cookie theft or session hijacking

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect common XSS patterns including <script> tags, JavaScript event handlers, and encoded payloads
• Implement Content Security Policy (CSP) headers and monitor for violation reports indicating script injection attempts
• Enable and review Drupal's watchdog logs for suspicious user input patterns and sanitization failures
• Use SentinelOne Singularity to monitor for anomalous browser behavior and script execution patterns on endpoints

Monitoring Recommendations

• Configure real-time alerting for XSS signature matches in WAF or IDS/IPS systems
• Monitor Drupal database tables for unexpected HTML or JavaScript content in text fields
• Implement browser-based monitoring to detect unauthorized script execution or DOM manipulation
• Review authentication logs for session anomalies that may indicate successful XSS-based session hijacking

How to Mitigate CVE-2024-12393

Immediate Actions Required

• Upgrade Drupal Core to version 10.2.11, 10.3.9, or 11.0.8 or later depending on your installed major version
• Audit content and database records for potential evidence of stored XSS payloads
• Enable strict Content Security Policy (CSP) headers to limit script execution sources
• Review and restrict user permissions to minimize the attack surface for authenticated XSS exploitation

Patch Information

Drupal has released security updates addressing this vulnerability. Organizations should update to the following patched versions:

• Drupal 10.2.x users: Upgrade to 10.2.11 or later
• Drupal 10.3.x users: Upgrade to 10.3.9 or later
• Drupal 11.0.x users: Upgrade to 11.0.8 or later

Detailed patching instructions and release notes are available in the Drupal Security Advisory SA-CORE-2024-003.

Workarounds

• Implement strict Content Security Policy headers to prevent inline script execution: script-src 'self'
• Deploy a Web Application Firewall with XSS detection rules as a temporary protective layer
• Restrict content editing permissions to trusted users only until patches can be applied
• Enable Drupal's built-in text format security features and ensure untrusted users cannot use formats that allow HTML

# Example CSP header configuration for Apache
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"

# Example CSP header configuration for Nginx
# Add to server block configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;";