Drupal Core Remote Code Execution VulnerabilityGHSA-3gx6-h57h-rm27
HIGHGHSA-3gx6-h57h-rm27 is a high-severity (CVSS 8.1) Deserialization of Untrusted Data vulnerability in drupal/core. It is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25) — treat it as actively exploited and patch now. A fix is available for drupal/core — see the affected versions and patch details below.
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2022-03-25. Federal agencies were required to remediate by 2022-04-15.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for GHSA-3gx6-h57h-rm27.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-3gx6-h57h-rm27 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
drupal/core🐘drupal/core🐘drupal/core🐘drupal/drupal🐘drupal/drupal🐘drupal/drupalReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | drupal/core | ≥ 8.6.0&&< 8.6.10 | 8.6.10composer require drupal/core:^8.6.10 |
| 🐘Packagist | drupal/core | ≥ 7.0.0&&< 7.62.0 | 7.62.0composer require drupal/core:^7.62.0 |
| 🐘Packagist | drupal/core | ≥ 8.0.0&&< 8.5.11 | 8.5.11composer require drupal/core:^8.5.11 |
| 🐘Packagist | drupal/drupal | ≥ 7.0.0&&< 7.62.0 | 7.62.0composer require drupal/drupal:^7.62.0 |
| 🐘Packagist | drupal/drupal | ≥ 8.0.0&&< 8.5.11 | 8.5.11composer require drupal/drupal:^8.5.11 |
| 🐘Packagist | drupal/drupal | ≥ 8.6.0&&< 8.6.10 | 8.6.10composer require drupal/drupal:^8.6.10 |
Affected Products
drupaldrupalResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Drupal < 8.6.9 - REST Module Remote Code Execution
by leonjza · Feb 25, 2019
Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution
by Charles Fol · Feb 23, 2019
Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)
by Metasploit · Mar 7, 2019
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for drupal/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update drupal/core to 8.6.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3gx6-h57h-rm27 is resolved across your whole dependency graph.
Workarounds
Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.
How to detect GHSA-3gx6-h57h-rm27
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-3gx6-h57h-rm27 -u https://target- Template
- Drupal - Remote Code Execution
- Severity
- high
- Impact
- Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected Drupal site.
- Remediation
- Apply the official security patch provided by Drupal to fix the deserialization vulnerability.
Template by ProjectDiscovery nuclei-templates (madrobot), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-3gx6-h57h-rm27 in your dependencies?
Find it across Packagist, including transitive dependencies.