CVE-2024-13311: Drupal File Extensions Module Vulnerability

CVE-2024-13311 Overview

CVE-2024-13311 affects the Drupal contributed module Allow All File Extensions for file fields. The module weakens Drupal's built-in file extension restrictions on file field uploads. An authenticated user with permission to upload files can leverage the module to submit files with extensions that would normally be blocked.

The vulnerability carries a CVSS 3.1 base score of 7.3 and is tracked under CWE category NVD-CWE-noinfo. Exploitation requires low privileges and user interaction over the network. Successful attacks can compromise confidentiality and integrity of the Drupal site hosting the module.

Critical Impact
Authenticated users can upload files with dangerous extensions, potentially enabling web shell delivery, content spoofing, or hosting of malicious payloads through a trusted Drupal site.

Affected Products

Drupal contributed module: Allow All File Extensions for file fields
All versions currently published by the allow_all_file_extensions_for_file_fields_project maintainer (see the Drupal Security Advisory for exact ranges)
Drupal sites that install the module and expose file upload fields to non-administrative roles

Discovery Timeline

2025-01-09 - CVE-2024-13311 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13311

Vulnerability Analysis

Drupal core enforces an allowlist of file extensions on every file field. The Allow All File Extensions for file fields module intentionally disables that allowlist so administrators can accept arbitrary file types. The vulnerability arises because the module's relaxed policy also removes safety checks that Drupal normally applies to prevent dangerous uploads.

An attacker with an account that has file upload permissions can submit files with executable or otherwise dangerous extensions. Depending on server configuration, uploaded files may be served with an interpreter such as PHP, opening the door to code execution. Even when interpretation is disabled, attackers can host phishing pages, malware, or spoofed content under the trusted domain.

The attack requires user interaction, meaning the exploit is triggered through the normal upload workflow rather than automatic processing. The scope remains unchanged, so the impact is contained to the vulnerable Drupal instance and its stored data.

Root Cause

The root cause is an insecure design decision within the contributed module. By overriding Drupal's extension allowlist without preserving compensating controls, the module removes a layer of input validation that protects file upload handlers from malicious content.

Attack Vector

Exploitation occurs over the network through the standard Drupal upload interface. An attacker authenticates to the site, navigates to a content type or form containing a file field governed by the module, and submits a file whose extension would normally be rejected. The module accepts the file, and the payload is stored under the site's public or private files directory.

Because no verified proof-of-concept is published, technical specifics for triggering downstream code execution depend on the target site's web server and MIME handling. Refer to the Drupal Security Advisory for authoritative details.

Detection Methods for CVE-2024-13311

Indicators of Compromise

Files with executable extensions such as .php, .phtml, .phar, .jsp, or .aspx present under Drupal's sites/default/files directory
Entries in the file_managed table referencing MIME types inconsistent with the declared extension
Web server access logs showing direct requests to uploaded files under the files directory returning HTTP 200 with dynamic content
Unexpected outbound network connections originating from the web server after a file upload event

Detection Strategies

Audit installed Drupal modules and flag any site that includes allow_all_file_extensions_for_file_fields
Inventory file field configurations and compare declared extensions against the effective extension list rendered at upload time
Correlate authenticated upload events with subsequent HTTP requests to the resulting file paths to identify potential web shell activity
Enable file integrity monitoring across the Drupal files directory to surface additions of executable content

Monitoring Recommendations

Ship Drupal watchdog logs and web server access logs to a centralized SIEM for correlation
Alert on upload events by low-privileged roles that produce files with server-executable extensions
Monitor for new PHP, Perl, or shell files created outside deployment windows

How to Mitigate CVE-2024-13311

Immediate Actions Required

Review whether the Allow All File Extensions for file fields module is required; uninstall it if the business need is not clear
Restrict file upload permissions to trusted roles only until a fixed version is applied
Reconfigure the web server to prevent execution of files stored in Drupal's public files directory
Scan the files directory for suspicious uploads created since the module was installed

Patch Information

Consult the Drupal Security Advisory for the fixed release version and upgrade instructions. Apply the maintainer's update through Drupal's standard module update workflow and verify the version after deployment.

Workarounds

Replace the module with per-field extension allowlists configured through Drupal's built-in file field settings
Configure the web server to serve the files directory with Content-Type: application/octet-stream and disable script handlers such as mod_php for that path
Place uploaded files behind an authentication or validation proxy that inspects content before delivery

bash

# Apache configuration example to block script execution in the Drupal files directory
<Directory "/var/www/drupal/sites/default/files">
    php_admin_flag engine off
    SetHandler none
    Options -ExecCGI
    AddType text/plain .php .phtml .phar .pl .py .jsp .asp .sh .cgi
</Directory>