Highly critical Drupal RCE flaw could lead to new Drupalgeddon, patch now!
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-6340 | Deserialization RCE in Drupal 8 Core Web Services (CVE-2019-6340) Several field types in Drupal 8.5.x and 8.6.x fail to properly sanitize data arriving from non-form sources (CWE-502, deserialization of untrusted data), which can lead to arbitrary PHP code execution on the server. The flaw is triggered remotely when a site has the Drupal 8 RESTful Web Services (rest) core module enabled and accepts PATCH or POST requests, or when other web services modules are enabled, such as JSON:API on Drupal 8 or the Services and RESTful Web Services contributed modules on Drupal 7. A successful attack yields unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, typically running as the web server user. Only Drupal sites meeting the web-services conditions are affected: Drupal 8 sites running versions before 8.5.11 or 8.6.10, and Drupal 7 sites using the Services or RESTful Web Services contributed modules. The flaw has public proof-of-concept exploits on Exploit-DB, was reported as under active exploitation shortly after disclosure, and is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25). Do: Upgrade Drupal 8 core to 8.5.11 or later, or 8.6.10 or later, per vendor instructions. If patching is not immediately possible, disable the RESTful Web Services and JSON:API modules or restrict untrusted PATCH/POST requests to their endpoints; Drupal 7 sites using Services or RESTful Web Services should apply the contributed module updates from this advisory. Review web server and module logs for suspicious POST/PATCH requests to REST or JSON:API routes as evidence of compromise. | 8.1 | 92% | KEV PoC ×2 |
| largeroughly 10,000–100,000 sites plausibly exposed (a subset of the hundreds of thousands of Drupal 8 deployments, limited to those with REST/JSON:API web services… |
Full article277 words · extracted from helpnetsecurity.com · click to collapse
A new Drupalgeddon might be brewing: a highly critical vulnerability affecting all versions of the popular content management framework could allow hackers to take over vulnerable Drupal installations and the websites running on them.
About the vulnerability (CVE-2019-6340)
The remote execution flaw exists because some field types do not properly sanitize data from non-form sources and this can be exploited to achieve arbitrary PHP code execution.
It is deemed highly critical because it can be exploited by unauthenticated attackers and only requires easily achievable user interaction (a visit to a malicious page).
Still, there are some good news: it was discovered by Samuel Mortenson of the Drupal Security Team, is currently not being exploited in the wild, and there is still no public exploit code or documentation on exploit development.
An additional mitigating factor is that only specific site configurations are affected by this vulnerability. Sites are affected if they have:
- The Drupal 8 core RESTful Web Services (rest) module enabled and allow PATCH or POST requests, or
- Another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7.
Fixes are available
The vulnerability has already been patched and users are advised to upgrade their installations to version 8.6.10 or 8.5.11.
“Be sure to install any available security updates for contributed projects after updating Drupal core,” the security team warned. “No core update is required for Drupal 7, but several Drupal 7 contributed modules do require updates.”
If a quick update is impossible, users can mitigate the danger by disabling all web services modules or configuring their web servers to not allow PUT/PATCH/POST requests to web services resources.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/02/21/cve-2019-6340/