Exploit in the Wild: #drupalgeddon2 - Analysis of CVE-2018-7600
Summary: On 28 March 2018, Drupal's core security team released advisory SA-CORE-2018-002 for CVE-2018-7600, later nicknamed drupalgeddon2, affecting Drupal 7.x before 7.58, 8.3.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1, with an estimated impact on over one million Drupal users and websites. The flaw stems from insufficient input validation on the Drupal 7 Form API and allows an anonymous, unauthenticated user to execute code remotely, with proof-of-concept code released into the wild on April 12, 2018 targeting the mail[] array and the #post_render function to run PHP's exec.
Why it matters: There is nothing mitigating access to this vulnerability: an anonymous user can reach it without authentication, and in-the-wild payloads have already been detected carrying reverse shells, backdoors, botnets, and crypto-miners against roughly one million affected Drupal users and sites.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-7600
- Related
- CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Detecting Apache Struts 2 Namespace RCE | Qualys Cyber Risks ·