Drupal RESTful Web Services unserialize() Remote Code Execution
Posted by deepcore on March 7, 2019 – 7:00 pm
This Metasploit module exploits a PHP unserialize() vulnerability in Drupal RESTful Web Services by sending a crafted request to the /node REST endpoint. As per SA-CORE-2019-003, the initial remediation was to disable POST, PATCH, and PUT, but Ambionics discovered that GET was also vulnerable (albeit cached). Cached nodes can be exploited only once.
Post a reply
You must be logged in to post a comment.