CVE-2024-45440
Drupal
CVE-2024-45440 in Drupal 11.x-dev allows Full Path Disclosure, exposing sensitive server information. This vulnerability occurs in core/authorize.php, even with error logging disabled, when hash_salt attempts to read a non-existent file. The SOCRadar Vulnerability Risk Score (SVRS) for CVE-2024-45440 is 52, indicating a moderate level of risk that requires attention. Although the CVSS score is also moderate at 5.3, the presence of active exploits significantly raises the threat level. Successful exploitation could reveal internal server paths, potentially aiding attackers in further compromising the system. Immediate patching or mitigation is recommended to prevent data leakage.
Description
CVE-2024-45440 is a vulnerability in Drupal 11.x-dev's core/authorize.php file. It allows for a Full Path Disclosure when the hash_salt value is set to the result of file_get_contents for a non-existent file, even with error logging disabled. This vulnerability stems from insecure handling of file operations, potentially leading to sensitive information exposure.
SVRS: 52. While the CVSS score is 5.3 (Medium), the SVRS score of 52 signifies a moderate risk level, indicating that immediate action is not necessary. However, proactive mitigation strategies are recommended.
Key Insights
- Potential for Sensitive Information Exposure: This vulnerability could expose file paths on the affected Drupal server, potentially revealing internal system structure, application directories, and configuration files.
- Error Logging Bypass: The vulnerability allows for disclosure even when error logging is disabled, making it harder to detect through traditional monitoring methods.
- Exploitation Requires User Interaction: The exploit requires a user to provide a specific
hash_saltvalue derived from a non-existent file, potentially limiting its impact in real-world scenarios. - Active Exploitation: While no specific threat actors or APT groups have been associated with this vulnerability yet, it's crucial to note that active exploits for CVE-2024-45440 have been published online, highlighting the potential for exploitation by malicious actors.
Mitigation Strategies
- Update to the Latest Drupal Version: Applying the latest security patch released by Drupal will address the vulnerability. Ensure all vulnerable Drupal instances are updated promptly.
- Secure Configuration: Review and adjust the Drupal configuration to restrict file access and input validation. Implement secure file access control and prevent users from manipulating the
hash_saltvariable. - Intrusion Detection Systems (IDS)/Security Information and Event Management (SIEM): Configure IDS/SIEM to detect suspicious activity related to file access patterns and any attempts to exploit the vulnerability.
- Regular Vulnerability Scanning: Regularly scan your Drupal installations for vulnerabilities and follow best practices for patch management to stay ahead of emerging threats.
Additional Information
If you have additional queries regarding this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.