Rapid7 Vulnerability & Exploit Database

Drupal RESTful Web Services unserialize() RCE

Back to Search

Drupal RESTful Web Services unserialize() RCE

Disclosed
02/20/2019
Created
03/19/2019

Description

This module exploits a PHP unserialize() vulnerability in Drupal RESTful Web Services by sending a crafted request to the /node REST endpoint. As per SA-CORE-2019-003, the initial remediation was to disable POST, PATCH, and PUT, but Ambionics discovered that GET was also vulnerable (albeit cached). Cached nodes can be exploited only once. Drupal updated SA-CORE-2019-003 with PSA-2019-02-22 to notify users of this alternate vector. Drupal < 8.5.11 and < 8.6.10 are vulnerable.

Author(s)

  • Jasper Mattsson
  • Charles Fol
  • Rotem Reiss
  • wvu <wvu@metasploit.com>

Platform

PHP,Unix

Architectures

php, cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/unix/webapp/drupal_restws_unserialize
msf exploit(drupal_restws_unserialize) > show targets
    ...targets...
msf exploit(drupal_restws_unserialize) > set TARGET < target-id >
msf exploit(drupal_restws_unserialize) > show options
    ...show and set options...
msf exploit(drupal_restws_unserialize) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;