CVE-2024-55635

What it actually does

The vulnerability permits injection of unneutralized user-supplied content into dynamically generated web pages, enabling execution of attacker-controlled JavaScript in victims' browsers.

Why it matters to the business

Organizations running older Drupal 7 sites face elevated risk of account takeover, data theft, or site defacement until patches are applied; the large number of downstream dependents increases overall ecosystem exposure.

How an attack unfolds

An attacker supplies crafted input containing script tags or event handlers through forms, URLs, or other entry points; the application fails to sanitize this input before rendering it in HTML output, causing the browser to execute the payload in the context of authenticated users.

How to fix it

Upgrade Drupal Core to version 7.102 or later; apply the commit fa67320cf2109f1102201da5f66fd189c56f8b25 if a direct patch is required for custom builds.

How to confirm the fix worked

Confirm the installed Drupal version is 7.102 or newer, review release notes for the XSS fix, and test input fields with known malicious payloads in a non-production environment to verify sanitization.

Typical attack path

1. Locate user-controlled input fields or parameters on a Drupal 7 site
2. Inject a proof-of-concept script payload that triggers on page load or interaction
3. Deliver the link or form submission to a target user or store the payload persistently
4. Capture session cookies, perform actions on behalf of the victim, or redirect users when the script executes

How to detect it

Review web server and application logs for requests containing script tags, onerror handlers, or encoded JavaScript; inspect rendered pages for unexpected inline scripts; check user-generated content stores for persistent malicious payloads.

What your security team should do

• Immediately upgrade all Drupal 7 instances to 7.102 or apply the referenced commit
• Audit custom modules and themes for similar input-handling weaknesses
• Enable content security policy headers as a defense-in-depth measure
• Monitor for unusual script execution or cookie access patterns in web logs