CVE-2020-13664: Arbitrary PHP Code Execution in Drupal Core
Summary
CVE-2020-13664: Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. Affects drupal across 3 version ranges.
>= 8.8.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
Fixed in 8.8.8, 8.9.1 or 9.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
- drupal/core · Packagist
The same CVE-2020-13664 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is an open-source content management system (CMS) that allows users to easily create and manage websites. It provides a flexible platform for building various types of websites, including blogs, e-commerce sites, and community forums. Drupal Core is the foundational software that powers Drupal websites. It includes essential features and functionality for managing content, user accounts, and site administration. Unfortunately, Drupal Core is vulnerable to an arbitrary PHP code execution vulnerability under certain circumstances.
Vulnerability Detail
The vulnerability in Drupal Core allows an attacker to execute arbitrary PHP code on a targeted server. To exploit this vulnerability, the attacker needs to trick an administrator into visiting a malicious site. Once the administrator visits the site, a carefully named directory is created on the file system. With this directory in place, the attacker can attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected by this issue. The vulnerability affects Drupal Core versions 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, and 9.0.1 prior to 9.0.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 8.8.88.8.8 -
>= 8.9.0, < 8.9.18.9.1 -
>= 9.0.0, < 9.0.19.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update Drupal Core to the latest version as soon as possible to mitigate the risk of exploitation.
Conclusion
In conclusion, the arbitrary PHP code execution vulnerability in Drupal Core poses a significant risk to websites using affected versions. To protect against potential exploitation, it is crucial to update Drupal Core to the latest version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal →
FAQ
Drupal Core is the foundational software that powers Drupal websites. It provides essential features and functionality for managing content, user accounts, and site administration.
An attacker can exploit this vulnerability by tricking an administrator into visiting a malicious site. This site will create a directory on the file system, allowing the attacker to attempt remote code execution.
Drupal Core versions 8.8.x prior to 8.8.8, 8.9.x prior to 8.9.1, and 9.0.1 prior to 9.0.1 are affected by this vulnerability.
Yes, Windows servers are more likely to be affected by this vulnerability.
No specific workaround is provided for this vulnerability. It is recommended to update Drupal Core to the latest version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
