Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Yet Another Drupal RCE Vulnerability - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Yet Another Drupal RCE Vulnerability

Drupal today released another patch addressing a remote code execution vulnerability. According to the advisory, the vulnerability is related to the issue patched about a month ago, but this variant has not been exploited yet. Please patch ASAP! 

An exploit for the vulnerability has been posted to pastebin [2] . This exploit does require authentication. 

With the March update, Drupal added a global sanitation function. This approach is often difficult to implement correctly. It is very difficult to sanitize and validate data before it is clear how it is being used, in particular if this is done for an existing and complex application like Drupal. We will see how this will work for Drupal in the long run.

[1] https://www.drupal.org/sa-core-2018-004
[2] https://pastebin.com/pRM8nmwj . (leads to exploit code)

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute
Twitter|

Johannes

3245 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!