Critical Drupal Core Vulnerability: ce qu'il faut savoir
Drupal is popular, free and open-source content management software. On March 28, the Drupal security team released patches for CVE-2018-7600, an unauthenticated remote code execution vulnerability in Drupal core. The vulnerability affects Drupal versions 6, 7 and 8. Patches have been released for versions 7.x, 8.3.x, 8.4.x and 8.5.x. No patches are expected for version 6 or 8.2.x and below.
Impact assessment
Drupal security advisories include a risk score based on the NIST Common Misuse Scoring System. This helps give an objective sense of the risk of different issues. The risk of this vulnerability, SA-CORE-2018-002, is scored 21/25 (Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default.
Tenable expects the impact of this vulnerability to be high. This vulnerability is similar to the infamous Struts vulnerability, in that it only requires a single HTTP request to exploit the target. However, unlike Struts, this vulnerability is believed to affect every Drupal endpoint. An attacker can leverage the vulnerability just by visiting the page, requiring no special privilege level.
Based on our analysis of the vulnerability, the widespread deployment of the target infrastructure and the potential ease of exploitation, the prediction is that real-world exploits will be developed rather quickly for this high-profile vulnerability. We can expect weaponized exploits within 24 to 48 hours of the patch’s availability. Twitter is already abuzz with activity on the topic. Vulnerable systems should be patched immediately.
Vulnerability details
The problem is that Drupal core accepts request parameters as array objects. While this is functionally no different than many other frameworks, a malicious user can pass an array object to the application with a keynote containing a payload. Drupal will process this without sanitization. A successful exploit attempt results in the potential compromise of the application and even the underlying operating system.
Urgently required actions and resources
Patch your Drupal installs immediately.
Tenable has released plugins 108688, 108695, 108698 and 109041 to detect vulnerable installations.
Tenable has also updated plugin 89684 to help identify systems that will not receive patches.Tenable.io Container Security detects all affected versions, and any Drupal installations in your existing containers will be detected during the automatic rescans.
Où trouver plus d'informations
- Drupal core security advisory: https://www.drupal.org/sa-core-2018-002
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
Articles connexes
Cybersecurity Snapshot: CISA Tells Tech Vendors To Squash Command Injection Bugs, as OpenSSF Calls on Developers To Boost Security Skills
July 12, 2024Check out CISA’s call for weeding out preventable OS command injection vulnerabilities. Plus, the Linux Foundation and OpenSSF spotlight the lack of cybersecurity expertise among SW developers. Meanwhile, GenAI deployments have tech leaders worried about data privacy and data security. And get the latest on FedRAMP, APT40 and AI-powered misinformation!
How Risk-based Vulnerability Management Boosts Your Modern IT Environment's Security Posture
July 11, 2024Vulnerability assessments and vulnerability management sound similar – but they’re not. As a new Enterprise Strategy Group white paper explains, it’s key to understand their differences and to shift from ad-hoc vulnerability assessments to continuous, risk-based vulnerability management (RBVM). Read on to check out highlights from this Tenable-commissioned study and learn how RBVM helps organizations attain a solid security and risk posture in hybrid, complex and multi-cloud environments.
Microsoft’s July 2024 Patch Tuesday Addresses 138 CVEs (CVE-2024-38080, CVE-2024-38112)
July 9, 2024Microsoft addresses 138 CVEs in its July 2024 Patch Tuesday release, with five critical vulnerabilities and three zero-day vulnerabilities, two of which were exploited in the wild.
- Plugins