Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass — CVE-2019-6340 Drupal 8.6.9 REST Auth Bypass examples | Kitploit
Tools/GitHubGitHub/devdungeon/cve-2019-6340-drupal-8.6.9-rest-auth-bypass
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationArchived
GitHubdevdungeon/cve-2019-6340-drupal-8.6.9-rest-auth-bypass

CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2019-6340 Drupal 8.6.9 REST Auth Bypass examples

View Repository
277 years agoNot yet reviewed

CVE-2019-6340 / SA-CORE-2019-003

Three scripts included to demonstrate how Drupal 8.6.9 is vulnerable to CVE-2019-6340:

  • create_node_via_rest.py - Example of normal authenticated node create with REST API
  • does_not_correspond.py - Proving the request is processed even without authentication
  • exploit.py - Exploit the deserialization and execute a remote command

Download Drupal 8.6.9 from https://www.drupal.org/project/drupal/releases/8.6.9 Do a vanilla install and turn on the four "Web Services" modules.

I did not do all of the investigation on my own, I used a few resources when writing these scripts:

  • https://www.ambionics.io/blog/drupal8-rce
  • https://github.com/g0rx/Drupal-SA-CORE-2019-003/blob/master/cve-2019-6340.py
  • https://www.drupal.org/sa-core-2019-003
  • Ronald Eddings - https://secdevops.ai/
Download Tool