Drupal core Remote Code Execution Vulnerability
Summary
GHSA-6mgp-v5cm-ghg5: Drupal core Remote Code Execution. Affects drupal/core across 3 version ranges.
>= 7.0, < 7.60
>= 8.0.0, < 8.5.8
>= 8.6.0, < 8.6.2
Fixed in 7.60, 8.5.8 or 8.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal core is a content management system (CMS) that allows users to create and manage websites. It provides a wide range of features and functionality for building and maintaining websites, including user authentication, content creation and editing, and website customization. However, a vulnerability has been discovered in Drupal core that could allow remote code execution.
Vulnerability Detail
The vulnerability in Drupal core exists in the DefaultMailSystem::mail() function, which is responsible for sending emails. This function does not properly sanitize certain variables used as shell arguments, which can be exploited by an attacker to execute arbitrary code on the server. This could lead to a complete compromise of the affected Drupal installation, allowing the attacker to gain unauthorized access, steal sensitive information, or perform other malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.607.60composer require drupal/core:7.60 -
>= 8.0.0, < 8.5.88.5.8composer require drupal/core:8.5.8 -
>= 8.6.0, < 8.6.28.6.2composer require drupal/core:8.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Drupal core is not immediately possible, a temporary workaround is to disable the use of the DefaultMailSystem class and switch to an alternative mail system implementation. This can be done by modifying the Drupal configuration to use a different mail system module, such as the SMTP module. Here is an example of how to configure Drupal to use the SMTP module:
- Install the SMTP module using Composer:
composer require drupal/smtp
- Enable the SMTP module:
drush en smtp
- Configure the SMTP module with the appropriate SMTP server settings in the Drupal administration interface.
By switching to an alternative mail system, the vulnerability in DefaultMailSystem::mail() can be mitigated until the Drupal core update can be applied.
Conclusion
The Drupal core Remote Code Execution vulnerability is a critical security issue that could allow an attacker to execute arbitrary code on a vulnerable Drupal installation. It is important to promptly update Drupal core to a version that includes the fix or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal core is the foundational software that powers Drupal websites. It provides the basic functionality and features for creating and managing websites.
Remote code execution is a security vulnerability that allows an attacker to execute arbitrary code on a remote server. This can lead to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your Drupal installation is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the necessary updates to Drupal core as soon as possible to mitigate the risk.
You can find more information about this vulnerability, including the technical details and the fixed versions of Drupal core, in the advisory on the GitHub Advisory Database: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
