Critical Drupal Core Vulnerability: What You Need to Know
Drupal is popular, free and open-source content management software. On March 28, the Drupal security team released patches for CVE-2018-7600, an unauthenticated remote code execution vulnerability in Drupal core. The vulnerability affects Drupal versions 6, 7 and 8. Patches have been released for versions 7.x, 8.3.x, 8.4.x and 8.5.x. No patches are expected for version 6 or 8.2.x and below.
Impact assessment
Drupal security advisories include a risk score based on the NIST Common Misuse Scoring System. This helps give an objective sense of the risk of different issues. The risk of this vulnerability, SA-CORE-2018-002, is scored 21/25 (Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default.
Tenable expects the impact of this vulnerability to be high. This vulnerability is similar to the infamous Struts vulnerability, in that it only requires a single HTTP request to exploit the target. However, unlike Struts, this vulnerability is believed to affect every Drupal endpoint. An attacker can leverage the vulnerability just by visiting the page, requiring no special privilege level.
Based on our analysis of the vulnerability, the widespread deployment of the target infrastructure and the potential ease of exploitation, the prediction is that real-world exploits will be developed rather quickly for this high-profile vulnerability. We can expect weaponized exploits within 24 to 48 hours of the patch’s availability. Twitter is already abuzz with activity on the topic. Vulnerable systems should be patched immediately.
Vulnerability details
The problem is that Drupal core accepts request parameters as array objects. While this is functionally no different than many other frameworks, a malicious user can pass an array object to the application with a keynote containing a payload. Drupal will process this without sanitization. A successful exploit attempt results in the potential compromise of the application and even the underlying operating system.
Urgently required actions and resources
Patch your Drupal installs immediately.
Tenable has released plugins 108688, 108695, 108698 and 109041 to detect vulnerable installations.
Tenable has also updated plugin 89684 to help identify systems that will not receive patches.Tenable.io Container Security detects all affected versions, and any Drupal installations in your existing containers will be detected during the automatic rescans.
Get more information
- Drupal core security advisory: https://www.drupal.org/sa-core-2018-002
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Related Articles
Foreshadow: Speculative Execution Attack Targets Intel SGX
August 14, 2018A flaw in Intel’s Software Guard Extensions implementation allows an attacker to access data stored in memory of other applications running on the same host, without the need for privilege escalation....
Advisory: Red Hat DHCP Client Command Injection Trouble
May 17, 2018On May 15, Red Hat disclosed a critical vulnerability in a script included in NetworkManager for the Dynamic Host Configuration Protocol (DHCP) client on Red Hat Enterprise Linux (RHEL). The vulnerabi...
Advisory: Intel...Simply Misunderstood?
May 11, 2018To close numerous security gaps, Microsoft, Adobe, Apple, Red Hat, Xen, VMware and other vendors have released a number of patches in the first 10 days of May. We discussed some of these in our recent...
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
As Pro-Russia Hactivists Target OT Systems, Here’s What You Need To Know
May 2, 2024U.S. and international cybersecurity and law enforcement agencies this week issued a joint fact sheet to highlight and safeguard against the continued malicious cyber activity conducted by pro-Russia hacktivists against operational technology (OT) devices in North America and Europe. Read on to get all the details and learn what actions to take today.
Tenable Bolsters Its Cloud Security Arsenal with Malware Detection
May 1, 2024Tenable Cloud Security is enhancing its capabilities with malware detection. Combined with its cutting-edge, agentless vulnerability-scanning technology, including its ability to detect anomalous behavior, this new capability makes Tenable Cloud Security a much more complete and effective solution. Read on to find out how.
- Plugins