A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x.
Impact
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 8.0.0 before 8.3.9Ecosystem versions | 8.3.9 |
| From 8.4.0 before 8.4.6Ecosystem versions | 8.4.6 |
| From 8.5.0 before 8.5.1Ecosystem versions | 8.5.1 |
| From 7.0 before 7.58Ecosystem versions | 7.58 |
| From 8.0 before 8.3.9Ecosystem versions | 8.3.9 |
| From 8.4.0 before 8.4.6Ecosystem versions | 8.4.6 |
| From 8.5.0 before 8.5.1Ecosystem versions | 8.5.1 |
Version evidence: OSV · DRUPAL-CORE-2018-002OSV · GHSA-7fh9-933g-885p
View original version evidence (125 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 7.0 before 7.58Ecosystem versions | 7.58 |
| From 8.0 before 8.3.9Ecosystem versions | 8.3.9 |
| From 8.4 before 8.4.6Ecosystem versions | 8.4.6 |
| From 8.5 before 8.5.1Ecosystem versions | 8.5.1 |
Version evidence: OSV · GHSA-7fh9-933g-885p
View original version evidence (83 explicit versions)
Original source description
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.
The security team has written an FAQ about this issue.
Edited 2020, February 13 to fix links to patch files.
References
- Security advisory www.drupal.org/sa-core-2018-002
- Security advisory nvd.nist.gov/vuln/detail/CVE-2018-7600
- Security advisory www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know
- Security advisory www.synology.com/support/security/Synology_SA_18_17
- Public exploit reference www.exploit-db.com/exploits/44482
- Public exploit reference www.exploit-db.com/exploits/44449
- Public exploit reference www.exploit-db.com/exploits/44448
- Security advisory www.debian.org/security/2018/dsa-4156
- Security advisory www.cisa.gov/known-exploited-vulnerabilities-catalog
- Source reference twitter.com/arancaytar/status/979090719003627521
- Source reference twitter.com/RicterZ/status/984495201354854401
- Source reference twitter.com/RicterZ/status/979567469726613504
- Source reference research.checkpoint.com/uncovering-drupalgeddon-2
- Source reference lists.debian.org/debian-lts-announce/2018/03/msg00028.html
- Security advisory groups.drupal.org/security/faq-2018-002
- Source reference greysec.net/showthread.php
- Security advisory github.com/g0rx/CVE-2018-7600-Drupal-RCE
- Source reference github.com/drupal/core
- Security advisory github.com/a2u/CVE-2018-7600
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml
- Security advisory blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714
- Security advisory badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600
- Source reference www.securityfocus.com/bid/103534
- Source reference www.securitytracker.com/id/1040598