Drupal Core Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• Known to be used in ransomware campaigns
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

CISA: Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.securityfocus.com/bid/103534Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1040598Broken LinkThird Party AdvisoryVDB Entry
• badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600Broken LinkThird Party Advisory
• blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714Third Party Advisory
• github.com/a2u/CVE-2018-7600Third Party Advisory
• github.com/g0rx/CVE-2018-7600-Drupal-RCEPatchThird Party Advisory
• greysec.net/showthread.phpBroken LinkIssue TrackingThird Party Advisory
• groups.drupal.org/security/faq-2018-002Vendor Advisory
• lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlThird Party Advisory
• research.checkpoint.com/uncovering-drupalgeddon-2ExploitThird Party Advisory
• twitter.com/RicterZ/status/979567469726613504Broken LinkThird Party Advisory
• twitter.com/RicterZ/status/984495201354854401Broken LinkThird Party Advisory
• twitter.com/arancaytar/status/979090719003627521Third Party Advisory
• www.debian.org/security/2018/dsa-4156Third Party Advisory
• www.drupal.org/sa-core-2018-002Vendor Advisory
• www.exploit-db.com/exploits/44448ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/44449ExploitThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/44482ExploitThird Party AdvisoryVDB Entry
• www.synology.com/support/security/Synology_SA_18_17Third Party Advisory
• www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-knowThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource