Cloudanix VulnDB

CVE-2024-11942

Medium · 5.9

Drupal core vulnerable to improper error handling

CVSS

5.9

EPSS

0.4%

Published

Dec 5, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Under rare setup conditions a website component can let someone move the site's main files to a different place and break the whole site.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
High
Impact
Denial Of Service
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A path traversal flaw in image upload handling under specific non-default configurations allows relocation of the entire webroot on the filesystem.

Why it matters to the business

Successful exploitation can render the site unavailable, leading to operational downtime and potential loss of service availability; low exploit probability and requirement for uncommon configurations reduce overall urgency.

How an attack unfolds

An attacker with upload privileges crafts an image upload request that, only when multiple non-default site settings are active simultaneously, triggers filesystem operations relocating the webroot and disabling the site.

How to fix it

Upgrade to fixed versions: drupal/drupal GIT commit dc18b154dafac9eec186f902c06cd875c722bda8 or the listed imagemagick patches for Ubuntu 14.04 and 16.04; review and correct any non-default configurations that enable the vulnerable code path.

How to confirm the fix worked

Confirm the installed version matches a fixed release, test image upload functionality under the previously vulnerable configurations, and verify webroot location remains unchanged after uploads.

Typical attack path

  1. Identify a target site running the vulnerable module with the required combination of non-default configurations
  2. Obtain or create an account with image upload permissions
  3. Craft and submit a specially formed image upload that exploits the path handling bug
  4. Verify webroot relocation has occurred and the site is inaccessible

How to detect it

Review web server and application logs for anomalous image upload requests that precede site outages or unexpected filesystem changes; examine upload handling code paths and configuration files for the required non-default settings.

What your security team should do

  • Apply the listed fixed versions immediately on all affected instances
  • Audit site configurations to eliminate the uncommon settings that enable the flaw
  • Monitor for any future updates given the stable but non-zero EPSS

The record

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site. The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.

Affected packages

Ecosystem Package Introduced Fixed
Packagist drupal/core 10.0.0 10.2.10
Bitnami drupal 10.0.0 10.3.0
Ubuntu:Pro:14.04:LTS drupal7 0 No fix
Ubuntu:Pro:16.04:LTS drupal7 0 No fix
packagist drupal/core 10.0.0 10.2.10

Related vulnerabilities