Highly Critical Drupal Security Advisory Released (SA-CORE-2019-003)
Drupal has released a security advisory to address a critical remote code execution vulnerability (CVE-2019-6340).
Background
On February 20, Drupal released a security advisory (SA-CORE-2019-003) for CVE-2019-6340, a remote code execution vulnerability in its software. This vulnerability has received a security risk rating of Highly Critical as defined by Drupal.
분석
According to the security advisory, arbitrary PHP code execution is possible due to a lack of data sanitization in certain field types linked to non-form sources. However, specific site configurations are affected by this vulnerability.
Affected Configurations
- Drupal 8: Sites that use JSON:API or RESTful Web Services (with PATCH or POST requests enabled); Update February 22: Sites that use RESTful Web Services, Hypertext Application Language (HAL) and HTTP Basic Authentication modules
- Drupal 7: Sites that use RESTful Web Services or the Services module
The vulnerability was discovered by the Drupal Security Team, so it does not appear that this vulnerability has been exploited in the wild at this time.
Update February 22: Additional analysis has recently been published in relation to this security advisory. This analysis suggests that the note about affected configurations requiring PATCH and POST requests to be enabled is not entirely accurate and claims remote code execution can occur using a GET request without authentication. Tenable has independently confirmed this analysis to be true. As a result, we have updated our Affected Configurations and Solution sections to reflect this new information.
However, we also discovered that RESTful Web Services module isn’t the only module required to trigger this exploit based on the new analysis above. It also requires the Hypertext Application Language (HAL) and HTTP Basic Authentication modules to be enabled as well.
Attempting POC exploit without HAL or HTTP Basic Auth enabled results in an error (Tested on Drupal 8.6.9).
Enabled modules required to trigger the exploit (note: Serialization is enabled when enabling RESTful Web Services).
Solution
Drupal recommends disabling all web services modules or disabling certain request types (PUT/PATCH/POST) server side to mitigate this vulnerability until patches can be applied.
Update February 22: Disabling PUT/PATCH/POST request types server side is not a feasible mitigation strategy on its own, as new analysis reveals other configurations that are vulnerable. As a result, Tenable strongly recommends upgrading to the patched versions of Drupal as soon as possible.
Drupal has released Drupal 8.6.10 and Drupal 8.5.11 to address this vulnerability. There is no core update for Drupal 7. However, there are security updates for contributed modules for Drupal 7 and Drupal 8. Some of the updated modules include:
- RESTful Web Services
- JSON:API
- Link
- Metatag
- Video
- Paragraphs
- Translation Management Tool
- Font Awesome Icons
Identifying affected systems
A list of Nessus plugins to identify this vulnerability will appear here as they’re released.
Get more information
- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2019-003
- Drupal: Security risk levels defined
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 60-day trial of Tenable.io Vulnerability Management.
관련 기사
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
CVE-2024-47575: Frequently Asked Questions About FortiJump Zero-Day in FortiManager and FortiManager Cloud
October 23, 2024Frequently asked questions about a zero-day vulnerability in Fortinet’s FortiManager that has reportedly been exploited in the wild.
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
October 22, 2024Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
Cybersecurity Snapshot: CISA Warns of Global Spear-Phishing Threat, While OWASP Releases AI Security Resources
November 8, 2024CISA is warning about a spear-phishing campaign that spreads malicious RDP files. Plus, OWASP is offering guidance about deepfakes and AI security. Meanwhile, cybercriminals have amplified their use of malware for fake software-update attacks. And get the latest on CISA’s international plan, Interpol’s cyber crackdown and ransomware trends.
Context Is King: From Vulnerability Management to Exposure Management
November 7, 2024Vulnerability management remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from vulnerability management to exposure management and effectively prioritize high-risk exposures across their complex attack surface.
- Vulnerability Management