Detections
Analytics

Drupal Coder Module Deserialization RCE

critical Nessus Plugin ID 92626

Language:

Synopsis

A PHP application running on the remote web server is affected by a remote code execution vulnerability.

Description

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the Coder module, specifically in file coder_upgrade.run.php, due to improper validation of user-supplied input to the unserialize() function. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary PHP code.

Solution

Upgrade the Coder module to version 7.x-1.3 / 7.x-2.6 or later.
Alternatively, remove the entire Coder module directory from any publicly accessible website.

See Also

https://www.drupal.org/node/2765575

https://www.drupal.org/project/coder

Plugin Details

Severity: Critical

ID: 92626

File Name: drupal_coder_rce.nasl

Version: 1.5

Type: remote

Family: CGI abuses

Published: 7/29/2016

Updated: 4/11/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:drupal:drupal

Required KB Items: www/PHP, installed_sw/Drupal

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/13/2016

Vulnerability Publication Date: 7/13/2016