Drupal Core Unrestricted File Upload Vulnerability

Background

Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The Drupal core package is the foundation of the CMS and includes essential features and functionality. However, a vulnerability has been discovered in the file upload functionality of Drupal core.

Vulnerability Detail

The vulnerability in Drupal core's file_save_upload() function allows users with the ability to upload files to bypass protections provided by Drupal's default .htaccess file. The file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, which can be exploited by users to upload system files such as .htaccess. This can potentially lead to unauthorized access or manipulation of the Drupal installation. The vulnerability affects versions 8.0.0 to 8.7.11 and 8.8.0 to 8.8.1 of the Drupal core package.

Workaround

If updating the Drupal core package is not immediately possible, a temporary workaround is to implement a custom validation function for file uploads that explicitly checks for and rejects filenames with leading or trailing dots. Here is an example of a validation function in PHP:

function custom_file_upload_validation(array &$file) {
  $filename = $file['name'];
  if (strpos($filename, '.') === 0 || strrpos($filename, '.') === strlen($filename) - 1) {
    $file['error'] = UPLOAD_ERR_EXTENSION;
  }
}

Conclusion

The Drupal core unrestricted file upload vulnerability allows users to upload system files and bypass Drupal's default protections. It is crucial to update the Drupal core package to the recommended versions to mitigate this vulnerability. Implementing the provided workaround can serve as a temporary solution until the update is applied. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for drupal/core →

FAQ