CVE-2024-55638

What it actually does

Potential PHP Object Injection via unsafe input to unserialize() in Drupal database code, which can lead to Remote Code Execution only when chained with a separate vulnerability that supplies the malicious serialized data.

Why it matters to the business

Low direct risk to Drupal sites because the flaw is not exploitable on its own and no known core exploits exist; however, unpatched sites remain exposed to chained attacks that could result in full site takeover, data loss, or defacement, with urgency driven by the need to apply the December 2024 fixes across the large Drupal ecosystem.

How an attack unfolds

An attacker first locates a separate vulnerability in a Drupal installation or third-party module that allows controlled input to reach unserialize(), then supplies a crafted PHP object that triggers dangerous method calls or property assignments during deserialization, ultimately achieving remote code execution; the added database-layer checks in the fixed versions block common unsafe paths even if the secondary flaw exists.

How to fix it

Upgrade Drupal core to 7.102, 10.2.11, or 10.3.9 (or later) immediately; apply the database-layer hardening commit f2093af42504324a1f55ca1783eab5b8a93afaa0; review and update any third-party database drivers per their release notes for additional configuration requirements.

How to confirm the fix worked

Confirm the installed Drupal version is at or above the fixed releases; test that custom or third-party database drivers no longer accept unsafe serialized input by reviewing driver code and configuration; re-run any existing deserialization test cases or security scans that target unserialize() calls.

Typical attack path

1. Scan for Drupal sites running versions before 7.102, 10.2.11, or 10.3.9
2. Identify or exploit a secondary vulnerability that can pass attacker-controlled data to unserialize()
3. Craft a serialized PHP object payload designed to execute arbitrary code or commands upon deserialization
4. Trigger the deserialization path through the database driver or related code
5. Establish persistence or perform post-exploitation actions on the compromised host

How to detect it

Review web server and application logs for unexpected serialized PHP objects reaching database-related code paths; inspect audit trails for any unserialize() calls with external or user-supplied data; check for post-exploitation artifacts such as newly created files or processes following deserialization events.

What your security team should do

• Apply the listed version upgrades within the next maintenance window
• Audit all third-party database drivers and modules for unsafe unserialize usage
• Monitor vulnerability disclosure feeds for any new chained exploits targeting Drupal deserialization
• Enable enhanced logging around database operations and deserialization functions for future detection