CVE-2020-13664: Drupal Core Arbitrary PHP code execution vulnerability
Summary
CVE-2020-13664: Drupal Core Arbitrary PHP code execution vulnerability. Affects drupal/core across 3 version ranges.
>= 8.8.0, < 8.8.8
>= 8.9.0, < 8.9.1
>= 9.0.0, < 9.0.1
Fixed in 8.8.8, 8.9.1 or 9.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2020-13664 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Core is a content management system (CMS) that allows users to create and manage websites. It provides a wide range of features and functionalities for building and maintaining websites. However, Drupal Core is vulnerable to an arbitrary PHP code execution vulnerability under certain circumstances. This vulnerability can be exploited by an attacker who tricks an administrator into visiting a malicious site, leading to the creation of a carefully named directory on the file system. With this directory in place, the attacker can attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected by this issue.
Vulnerability Detail
The arbitrary PHP code execution vulnerability in Drupal Core allows an attacker to execute arbitrary PHP code on a vulnerable system. By tricking an administrator into visiting a malicious site, the attacker can create a directory with a specific name on the file system. This directory is then used to attempt a brute force attack to exploit a remote code execution vulnerability. Successful exploitation of this vulnerability can lead to unauthorized access, data compromise, and potential control over the affected system. It is important to note that this vulnerability primarily affects Windows servers.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.8.0, < 8.8.88.8.8composer require drupal/core:8.8.8 -
>= 8.9.0, < 8.9.18.9.1composer require drupal/core:8.9.1 -
>= 9.0.0, < 9.0.19.0.1composer require drupal/core:9.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can mitigate the risk by implementing strong access controls, regularly updating Drupal Core and its modules, and monitoring for any suspicious activity on the website. It is also advisable to restrict access to the administrative interface and apply necessary security measures to protect the server hosting the Drupal installation.
Conclusion
The arbitrary PHP code execution vulnerability in Drupal Core poses a significant risk to websites running on vulnerable versions. It is crucial for administrators to update Drupal Core to the patched versions and follow best practices for website security. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal Core is a content management system (CMS) that allows users to create and manage websites. It provides a wide range of features and functionalities for building and maintaining websites.
This vulnerability can be exploited by tricking an administrator into visiting a malicious site, resulting in the creation of a directory on the file system. The attacker can then attempt to exploit a remote code execution vulnerability through brute force.
Windows servers are most likely to be affected by this vulnerability.
Successful exploitation of this vulnerability can lead to unauthorized access, data compromise, and potential control over the affected system.
To protect your Drupal installation, it is recommended to update Drupal Core to the latest version, implement strong access controls, regularly update modules, and monitor for suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
