-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient input validation in Drupal's Form API and rendering system. Attackers could inject array keys starting with '#' (e.g., #post_render, #lazy_builder) via user-controlled parameters like the registration form's mail field. These keys were processed by FormBuilder::doBuildForm and Renderer::renderRoot, which executed callbacks without proper authorization. The absence of RequestSanitizer::stripDangerousValues in vulnerable versions allowed this injection. The exploit leveraged AJAX callbacks (e.g., element_parents) to trigger rendering of malicious arrays, leading to RCE. The patch introduced input sanitization to strip dangerous keys, confirming the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 7.0, < 7.58 | 7.58 |
| drupal/core | composer | >= 8.0, < 8.3.9 | 8.3.9 |
| drupal/core | composer | >= 8.4.0, < 8.4.6 | 8.4.6 |
| drupal/core | composer | >= 8.5.0, < 8.5.1 | 8.5.1 |
| drupal/drupal | composer | >= 7.0, < 7.58 | 7.58 |
| drupal/drupal | composer | >= 8.0, < 8.3.9 | 8.3.9 |
| drupal/drupal | composer | >= 8.4, < 8.4.6 | 8.4.6 |
| drupal/drupal | composer | >= 8.5, < 8.5.1 | 8.5.1 |