Get full access to Hands-On Web Penetration Testing with Metasploit and 60K+ other titles, with a free 10-day trial of O'Reilly.

There are also live events, courses curated by job role, and more.

Start your free trial

The RESTful Web Services exploit – unserialize()

In February 2019, CVE-2019-6340 was released, which disclosed a bug in the RESTful web services module of Drupal. This bug can be exploited to perform RCE. RCE is only possible if the Drupal installation has all the web services installed (HAL, Serialization, RESTful Web Services, and HTTP Basic Authentication, shown in the following screenshot):

The RESTful Web Services module communicates with Drupal using REST APIs, which can perform operations such as update, read, and write on website resources. It depends on the serialization module for the serialization of data that is sent to and from ...

Get Hands-On Web Penetration Testing with Metasploit now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Don’t leave empty-handed

Get Mark Richards’s Software Architecture Patterns ebook to better understand how to design components—and how they should interact.

It’s yours, free.

Get it now

Check it out now on O’Reilly

Dive in for free with a 10-day trial of the O’Reilly learning platform—then explore all the other resources our members count on to build skills and solve problems every day.

Start your free trial Become a member now