CVE-2024-55636

What it actually does

The vulnerability allows PHP object injection through unsafe deserialization in Drupal core classes, which when chained with a separate input-passing flaw can result in arbitrary file deletion; type hints were added to affected class properties to prevent exploitation.

Why it matters to the business

Organizations running older Drupal versions face elevated risk of data loss or site compromise if an attacker chains this with another vulnerability, potentially disrupting operations and requiring emergency patching.

How an attack unfolds

An attacker first identifies and exploits a separate vulnerability that supplies attacker-controlled data to a Drupal unserialize call, then leverages the resulting object injection to delete arbitrary files on the server.

How to fix it

Upgrade Drupal core to 10.2.11 or later, 10.3.9 or later, or 11.0.8 or later; apply the commit 3712d59414f556474f990a503c3f7c295f8c719f; ensure any custom subclasses of affected core classes also declare property types.

How to confirm the fix worked

Verify Drupal version is at or above the fixed releases; review custom code extending core classes for missing type declarations; test that unserialize operations reject unsafe input.

Typical attack path

1. Locate a secondary vulnerability allowing unsafe data to reach unserialize()
2. Craft a serialized PHP object payload targeting vulnerable Drupal core classes
3. Trigger deserialization to achieve arbitrary file deletion
4. Use deleted files to disrupt service or enable further access

How to detect it

Review web server and application logs for unexpected file deletion events or errors related to unserialize operations; inspect for any evidence of chained exploits attempting to pass serialized data to Drupal endpoints.

What your security team should do

• Immediately upgrade all Drupal instances to the fixed versions listed
• Audit custom code for extensions of affected classes and add type hints
• Monitor for any chained deserialization attempts in application logs
• Prioritize patching given the potential for file deletion when combined with other flaws