Vulnerability:Drupal Core Remote Code Execution

On February 20th, Drupal released a security advisory of a vulnerability potentially allowing for remote code execution in Drupal versions 8.6.x and 8.5.x, as well as some modules in Drupal 7. The vulnerability is a result of improper sanitization of non-form sources. There have been no reports of exploits in the wild and no proof-of-concept has been released as of yet.

Recommendations

• If you are on Drupal 8.6.x or 8.5.x, update to the latest versions (released).
• Update any installed modules for your Drupal instances, especially if you are on Drupal 7.
• Leverage the ZeroFOX platform to monitor for Drupal vulnerabilities and any relevant patches or updates.

Details

Drupal security team released security advisory SA-CORE-2019-003, which is a remote code execution vulnerability referred in CVE-2019-6340. The team recommends anyone using 8.6.x or 8.5.x to update core immediately, as well as Drupal 7 users to update their modules. The information released by Drupal was that the core code was not sanitizing non-form data correctly, resulting in remote code execution.

The site is vulnerable if the following two conditions are met:

• The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests; or
• The site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7.

To immediately mitigate, turn off any REST functions that require submitting form data. Drupal recommends PUT, PATCH and POST.