CVE-2024-45440

What it actually does

The flaw triggers an error in core/authorize.php when hash_salt is configured via file_get_contents on a non-existent file, resulting in full server path disclosure regardless of error logging configuration.

Why it matters to the business

Attackers gain visibility into internal directory structures, which can accelerate reconnaissance and increase the likelihood of successful follow-on attacks against the application.

How an attack unfolds

An attacker supplies or influences a hash_salt value that attempts to read a missing file through file_get_contents; the resulting error bypasses logging controls and leaks the absolute path, and weaponized tooling can automate repeated triggers to map the environment.

How to fix it

Upgrade Drupal to a version that prevents the path disclosure in authorize.php; ensure hash_salt values reference only existing, controlled files and review custom error-handling settings.

How to confirm the fix worked

After remediation, attempt to reproduce the non-existent file condition via hash_salt and confirm that no full path appears in responses or logs even when logging is disabled.

Typical attack path

1. Identify an exposed Drupal installation running the vulnerable code path
2. Manipulate or observe the hash_salt configuration to reference a non-existent file
3. Trigger the authorize.php endpoint to induce the error condition
4. Capture the resulting error output containing the full file path
5. Use the disclosed path to inform subsequent exploitation attempts

How to detect it

Search web server and application error logs for entries originating from core/authorize.php that contain file path strings or file_get_contents failures; correlate with requests that manipulate hash_salt parameters.

What your security team should do

• Prioritize patching all Drupal 11.x-dev instances due to weaponized exploit maturity
• Audit hash_salt configurations across environments to eliminate references to potentially missing files
• Enable centralized logging and monitoring for any authorize.php error events
• Review downstream dependents and update build pipelines to enforce the fix once released