Drupal Coder Module Deserialization RCE

Critical Nessus Plugin ID 92626

Synopsis

A PHP application running on the remote web server is affected by a remote code execution vulnerability.

Description

The version of Drupal running on the remote web server is affected by a remote code execution vulnerability in the Coder module, specifically in file coder_upgrade.run.php, due to improper validation of user-supplied input to the unserialize() function. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary PHP code.

Solution

Upgrade the Coder module to version 7.x-1.3 / 7.x-2.6 or later.
Alternatively, remove the entire Coder module directory from any publicly accessible website.

See Also

https://www.drupal.org/node/2765575

https://www.drupal.org/project/coder

Plugin Details

Severity: Critical

ID: 92626

File Name: drupal_coder_rce.nasl

Version: 1.4

Type: remote

Family: CGI abuses

Published: 2016/07/29

Modified: 2018/06/13

Dependencies: 18638

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: cpe:/a:drupal:drupal

Required KB Items: installed_sw/Drupal, www/PHP

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2016/07/13

Vulnerability Publication Date: 2016/07/13

Reference Information

EDB-ID: 40149