CVE-2024-55637: Drupal Core RCE Vulnerability

CVE-2024-55637 Overview

CVE-2024-55637 is a critical Insecure Deserialization vulnerability affecting Drupal Core that enables Object Injection attacks. The vulnerability exists due to a chain of methods (gadget chain) within Drupal core that can be exploited when an insecure deserialization vulnerability exists on the site. While the gadget chain itself does not present a direct threat, it serves as a critical exploitation vector that can lead to remote code execution if the application deserializes untrusted data due to another vulnerability.

Critical Impact

This vulnerability can be chained with other deserialization flaws to achieve full remote code execution on affected Drupal installations, potentially allowing attackers to gain complete control of the web server.

Affected Products

• Drupal Core versions 8.0.0 through 10.2.10 (fixed in 10.2.11)
• Drupal Core versions 10.3.0 through 10.3.8 (fixed in 10.3.9)
• Drupal Core versions 11.0.0 through 11.0.7 (fixed in 11.0.8)

Discovery Timeline

• 2024-12-10 - CVE-2024-55637 published to NVD
• 2025-06-02 - Last updated in NVD database

Technical Details for CVE-2024-55637

Vulnerability Analysis

This vulnerability involves an exploitable PHP gadget chain present within Drupal Core. In object-oriented PHP applications, deserialization of untrusted data can lead to Object Injection attacks where an attacker crafts a malicious serialized object. When this object is deserialized, it can trigger a series of method calls (magic methods like __destruct(), __wakeup(), or __toString()) that chain together to perform unintended actions.

The Drupal Core gadget chain identified in CVE-2024-55637 provides attackers with the necessary building blocks to escalate from an initial deserialization flaw to arbitrary code execution. This is particularly dangerous because Drupal is widely deployed across enterprise and government environments.

Root Cause

The root cause is the presence of a usable gadget chain within Drupal Core's codebase. This chain consists of classes and methods that, when combined through PHP's serialization/deserialization mechanism, can be manipulated by an attacker to achieve malicious outcomes. The vulnerability falls under CWE-502 (Deserialization of Untrusted Data) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes).

While Drupal itself may properly validate input in most cases, if any custom module, third-party extension, or configuration introduces an insecure deserialization point, this gadget chain becomes immediately exploitable.

Attack Vector

The attack is network-based and can be executed without authentication or user interaction. An attacker would need to:

1. Identify a deserialization entry point on the target Drupal site (e.g., through a vulnerable module or custom code)
2. Craft a malicious serialized PHP object utilizing the Drupal Core gadget chain
3. Submit the payload to the vulnerable endpoint
4. Upon deserialization, the gadget chain executes, leading to arbitrary code execution

The exploitation mechanism relies on PHP's unserialize() function being called on attacker-controlled input, which then triggers the gadget chain to execute arbitrary commands on the server. See the Drupal Security Advisory for detailed technical information about the vulnerability.

Detection Methods for CVE-2024-55637

Indicators of Compromise

• Unusual PHP serialized data in HTTP request parameters, POST bodies, or cookies containing Drupal-specific class names
• Unexpected outbound network connections from the web server process
• New or modified files in Drupal installation directories, particularly in /sites/default/files/ or temporary directories
• Suspicious PHP process spawning or command execution patterns in server logs

Detection Strategies

• Monitor web application logs for serialized PHP object patterns (strings starting with O: followed by class names)
• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP payloads in requests
• Use file integrity monitoring on critical Drupal directories to detect unauthorized modifications
• Deploy runtime application self-protection (RASP) solutions to detect deserialization attacks

Monitoring Recommendations

• Enable detailed logging for all PHP deserialization operations on Drupal sites
• Configure alerts for any unserialize() calls on user-supplied data through PHP monitoring tools
• Monitor for creation of new admin accounts or privilege escalation events in Drupal
• Track system calls and process execution patterns from web server processes for anomalous behavior

How to Mitigate CVE-2024-55637

Immediate Actions Required

• Upgrade Drupal Core immediately to version 10.2.11, 10.3.9, or 11.0.8 depending on your branch
• Audit all custom modules and third-party extensions for insecure deserialization points
• Review and restrict file permissions on Drupal installation directories
• Implement network segmentation to limit potential lateral movement in case of compromise

Patch Information

Security patches have been released by the Drupal Security Team. Affected sites should upgrade to the following patched versions:

• Drupal 10.2.x: Upgrade to 10.2.11 or later
• Drupal 10.3.x: Upgrade to 10.3.9 or later
• Drupal 11.0.x: Upgrade to 11.0.8 or later

For detailed patch information and upgrade instructions, refer to the official Drupal Security Advisory SA-CORE-2024-007.

Workarounds

• If immediate patching is not possible, conduct an audit to identify and disable any modules that may deserialize user input
• Implement WAF rules to block requests containing serialized PHP objects
• Restrict network access to Drupal administrative endpoints and limit exposure of the application to trusted networks only
• Consider using PHP's allowed_classes parameter with unserialize() in custom code to prevent arbitrary object instantiation

# Example: Check current Drupal version
drush status --field=drupal-version

# Update Drupal Core using Composer
composer update drupal/core "drupal/core-*" --with-all-dependencies

# Clear caches after update
drush cache:rebuild