Drupal is popular, free and open-source content management software. On March 28, the Drupal security team released patches for CVE-2018-7600, an unauthenticated remote code execution vulnerability in Drupal core. The vulnerability affects Drupal versions 6, 7 and 8. Patches have been released for versions 7.x, 8.3.x, 8.4.x and 8.5.x. No patches are expected for version 6 or 8.2.x and below.
Impact assessment
Drupal security advisories include a risk score based on the NIST Common Misuse Scoring System. This helps give an objective sense of the risk of different issues. The risk of this vulnerability, SA-CORE-2018-002, is scored 21/25 (Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default.
Tenable expects the impact of this vulnerability to be high. This vulnerability is similar to the infamous Struts vulnerability, in that it only requires a single HTTP request to exploit the target. However, unlike Struts, this vulnerability is believed to affect every Drupal endpoint. An attacker can leverage the vulnerability just by visiting the page, requiring no special privilege level.
Based on our analysis of the vulnerability, the widespread deployment of the target infrastructure and the potential ease of exploitation, the prediction is that real-world exploits will be developed rather quickly for this high-profile vulnerability. We can expect weaponized exploits within 24 to 48 hours of the patch’s availability. Twitter is already abuzz with activity on the topic. Vulnerable systems should be patched immediately.
Vulnerability details
The problem is that Drupal core accepts request parameters as array objects. While this is functionally no different than many other frameworks, a malicious user can pass an array object to the application with a keynote containing a payload. Drupal will process this without sanitization. A successful exploit attempt results in the potential compromise of the application and even the underlying operating system.
Urgently required actions and resources
Patch your Drupal installs immediately.
Tenable has released plugins 108688, 108695 and 108698 to detect vulnerable installations.
Tenable has also updated plugin 89684 to help identify systems that will not receive patches.Get more information
- Drupal core security advisory: https://www.drupal.org/sa-core-2018-002
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management