CVE-2017-6381: Drupal Remote Code Execution
Summary
CVE-2017-6381: Drupal Remote code execution. Affects drupal/core versions >= 8.0, < 8.2.7. Fixed in 8.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The vulnerability identified as CVE-2017-6381 affects Drupal versions before 8.2.2. Drupal relies on various third-party libraries, and in this case, a vulnerable development library included with Drupal 8 development dependencies exposes it to remote code execution. However, the default .htaccess protection against PHP execution and the fact that Composer development dependencies are not normally installed mitigate the risk to some extent.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary code remotely on a Drupal site running an affected version. This can lead to a complete compromise of the site, enabling the attacker to perform various malicious activities such as stealing sensitive data, modifying content, or even taking control of the underlying server. The vulnerability is considered high severity with a CVSS score of 8.1. It is important to note that the vulnerability is only present in Drupal versions before 8.2.2.
How To Fix
Minimum fixed version
8.2.7
This is the first release that contains the fix.
composer require drupal/core:8.2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by updating Drupal to the latest version and removing the mentioned directory should effectively address the issue.
Conclusion
The CVE-2017-6381 vulnerability in Drupal exposes sites running affected versions to remote code execution. To mitigate the risk, it is essential to update Drupal to version 8.2.7 or later and remove the mentioned directory from production deployments. Regularly monitoring for open-source vulnerabilities using tools like Vulert can help ensure the security of your Drupal site. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and web applications.
Remote code execution refers to the ability of an attacker to execute arbitrary code on a target system or application remotely, often leading to complete compromise.
You can use the Vulert Playground at Vulert Scanner to check if your Drupal site is affected by this vulnerability. Simply provide your composer.lock file to analyze and receive real-time alerts for open-source vulnerabilities.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
While specific exploits may exist, they have not been mentioned in the provided information. However, it is crucial to address the vulnerability promptly by applying the recommended fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
