CVE-2019-6340

What Is Drupal?

Drupal is a widely used open-source content management system (CMS) that powers everything from personal blogs to large government and enterprise websites (Drupal has historically been popular with US federal agencies and universities). Its modular architecture, including the core RESTful Web Services module, allows sites to expose content and functionality via APIs — a convenience that also expands the attack surface if input handling in those modules is flawed.

Overview

CVE-2019-6340 is a critical remote code execution vulnerability in Drupal Core, sometimes referred to informally as part of the "Drupageddon 2" lineage of Drupal deserialization bugs. Some field types in Drupal do not properly sanitize data arriving from non-form sources — such as REST API requests — which, on sites with the RESTful Web Services module enabled (and, depending on configuration, even without it in some scenarios), can lead to arbitrary PHP code execution. CVSS score: 8.1.

Technical Details

The vulnerability (CWE-502, Deserialization of Untrusted Data) arises because certain Drupal field types accept and process serialized data submitted through non-form entry points, like REST endpoints, without applying the same sanitization used for standard form submissions. An attacker who submits a specially crafted payload to a vulnerable REST endpoint can trigger deserialization of attacker-controlled data, ultimately achieving arbitrary PHP code execution on the server. The Drupal Security Team noted that some sites without the RESTful Web Services module enabled could still be vulnerable depending on other enabled modules, which broadened the practical impact well beyond sites obviously running exposed APIs. Attack Complexity is rated High, reflecting some dependency on site configuration for reliable exploitation, but no authentication or user interaction is required.

Discovery

This vulnerability was disclosed and patched by the Drupal Security Team as SA-CORE-2019-003, following the project's standard coordinated disclosure process for core vulnerabilities.

Exploitation Context

CVE-2019-6340 was exploited at scale shortly after public disclosure, with attackers scanning the internet for unpatched Drupal sites to deploy cryptomining malware and web shells — a pattern consistent with prior high-profile Drupal core RCE bugs (such as the original "Drupageddon," CVE-2014-3704, and SA-CORE-2018-002/004, the "Drupalgeddon2" pair). CISA's KEV listing confirms this vulnerability continues to be exploited in the wild years later, reflecting how many Drupal installations remain unpatched or unmaintained long after fixes are available.

Remediation

1. Upgrade Drupal Core to the patched versions referenced in SA-CORE-2019-003 (Drupal 8.6.10, 8.5.11, or later, as applicable to the release track) — treat any older version as vulnerable.
2. Disable the RESTful Web Services module if it is not required, and audit any custom or contributed modules that expose non-form data entry points.
3. Restrict access to REST API endpoints using authentication and network-level controls where they must remain enabled.
4. Scan for web shells and unauthorized files on any Drupal site that was internet-exposed and unpatched around the February 2019 disclosure window.
5. Establish a regular Drupal core and module update cadence, given the CMS's recurring history as a target for mass exploitation following core vulnerability disclosures.