Project: 
DRD Agent
Date: 
2018-April-25
Security risk: 
Critical 15∕25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
PHP object injection
Affected versions: 
<3.7.0
Description: 

This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for administrators in a central dashboard.

The modules (DRD and DRD Agent) encrypt the data which is exchanged between them but in order to do so, they use the PHP serialize/unserialize functions instead of the json_encode/json_decode combination. As the unserialize function is called on unauthenticated content, this introduces a PHP object injection vulnerability.

Solution: 

Install the latest version:

  • If you use the DRD Agent module for Drupal 8.x, upgrade to DRD Agent 8.x-3.7
  • If you use the DRD Agent module for Drupal 7.x, upgrade to DRD Agent 7.x-3.5
    • Reported By: 
    Fixed By: 
    Coordinated By: