{
  "Name": "Drupal Core Arbitrary PHP Code Execution Vulnerability(CVE-2019-6340)",
  "Description": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)",
  "Product": "Drupal",
  "Homepage": "http://www.drupal.org/",
  "DisclosureDate": "2019-02-21",
  "Author": "mahui@gobies.org",
  "GifAddress": "https://raw.githubusercontent.com/gobysec/GobyVuls/master/Drupal/CVE-2019-6340/CVE-2019-6340.gif",
  "FofaQuery": "app=\"Drupal\"",
  "Level": "3",
  "Impact": "<p>1、启用了Drupal 8核心RESTful Web服务（rest）模块，并允许PATCH或POST请求</p> <p>2、启用了另一个Web服务模块，如Drupal 8中的JSON：API，或Drupal 7中的Services或RESTful Web Services</p> <p>上述两种情况可能导致php代码执行</p> ",
  "Recommendation": "Drupal官方已经发布了最新版本，请受影响的用户尽快升级进行防护。<a href=\"https://www.drupal.org/sa-core-2019-003\" target=\"_blank\">https://www.drupal.org/sa-core-2019-003</a>",
  "References": [
    "http://www.securityfocus.com/bid/107106",
    "https://www.drupal.org/sa-core-2019-003",
    "https://www.exploit-db.com/exploits/46452/",
    "https://www.exploit-db.com/exploits/46459/",
    "https://www.exploit-db.com/exploits/46510/",
    "https://www.synology.com/security/advisory/Synology_SA_19_09",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-6340",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6340"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "Name": "cmd",
      "Type": "input",
      "Value": "whoami"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [],
   "ExploitSteps": [],
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2019-6340"
  ],
  "CVSSScore": "8.1",
  "AttackSurfaces": {
    "Application": ["Drupal"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}