Network Attack Trends: Internet of Threats (November 2020
60
CVE-2018-7600
KEV ransomware PoC ×4massUnauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2)
CISA: Drupal Core Remote Code Execution Vulnerability
CVSS 3.1
9.8 critical
EPSS
100%p100
Published
()
KEV added
AI analysis
CVE-2018-7600, widely known as 'Drupalgeddon 2', is an unauthenticated remote code execution flaw in Drupal Core caused by insufficient input validation (CWE-20) in how the CMS processes certain structured request data. It can be triggered through multiple attack vectors, such as crafted parameters submitted to commonly used form and rendering features that are reachable by anonymous users with a single HTTP request. Successful exploitation lets an attacker run arbitrary code under the web application, typically resulting in complete site compromise, and CISA notes the flaw has been used in ransomware operations. Any site running unpatched Drupal 7.x or 8.x core is affected; Drupal's installed base at the time of disclosure was on the order of one million sites. Exploitation is confirmed in the wild (CISA KEV, added 2021-11-03), EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is recorded in the supplied data.
What to do: Upgrade immediately per vendor instructions: Drupal 7.58, 8.5.1, or the corresponding 8.4.6/8.3.9 updates if you remain on older 8.x branches, prioritizing internet-facing sites. Because this flaw has been exploited in the wild and used in ransomware operations, also check patched sites for backdoors, unexpected administrator accounts, modified core files, and rotate credentials.
Affected
| Drupal Core | Drupal 7.x prior to 7.58 and Drupal 8.x prior to 8.5.1 (prior to 8.4.6 on the 8.4.x branch and prior to 8.3.9 on the 8.3.x branch); version ranges per vendor ad |
Estimated exposure
mass≈1,000,000 sites (Drupal's self-reported installed base at time of disclosure) — Drupal community and vendor statistics put the global installed base at roughly one million sites in 2018, most of which were running vulnerable 7.x/8.x releases when the flaw was disclosed.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
CISA Known Exploited Vulnerability
- Affected
- Drupal Drupal Core
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Known
In the news20 stories
60
Muhstik Botnet Targeting Redis Servers Using Recently Disclosed Vulnerability
60
60
Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems
60
Top 30 Critical Security Vulnerabilities Most Exploited by Hackers
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60