Drupal core Arbitrary PHP code execution
Summary
GHSA-gxxj-g9v8-w28p: Drupal core Arbitrary PHP code execution. Affects drupal/core across 4 version ranges.
>= 7.0.0, < 7.75
>= 8.0.0, < 8.8.12
>= 8.9.0, < 8.9.10
>= 9.0.0, < 9.0.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal core is a widely used content management system (CMS) that provides a framework for building websites and applications. It utilizes various libraries and packages to enhance its functionality. One such library is the PEAR Archive_Tar library, which is used by Drupal for handling archive files. However, a security vulnerability has been discovered in the PEAR Archive_Tar library, which affects Drupal installations that allow the upload and processing of certain file types, including .tar, .tar.gz, .bz2, and .tlz.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28948 and CVE-2020-28949, allows for arbitrary PHP code execution. If an attacker uploads a malicious archive file, they can exploit this vulnerability to execute arbitrary code on the server. This can lead to various consequences, such as unauthorized access, data manipulation, or even complete compromise of the affected Drupal installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.757.75composer require drupal/core:7.75 -
>= 8.0.0, < 8.8.128.8.12composer require drupal/core:8.8.12 -
>= 8.9.0, < 8.9.108.9.10composer require drupal/core:8.9.10 -
>= 9.0.0, < 9.0.99.0.9composer require drupal/core:9.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the ability to upload and process .tar, .tar.gz, .bz2, and .tlz files until the Drupal core is updated to a fixed version. This can be achieved by modifying the file upload settings in the Drupal configuration.
Conclusion
The Drupal core Arbitrary PHP code execution vulnerability poses a significant risk to Drupal installations that allow the upload and processing of certain archive file types. To mitigate this vulnerability, it is crucial to prevent untrusted users from uploading these file types and promptly update Drupal core to a fixed version. By following these steps, the risk of exploitation can be minimized. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal core is the foundational software of the Drupal content management system. It provides essential features and functionality for building websites and applications.
This vulnerability affects Drupal installations that allow the upload and processing of .tar, .tar.gz, .bz2, or .tlz files. If exploited, it can lead to arbitrary PHP code execution and potential compromise of the affected Drupal installation.
The potential consequences of this vulnerability include unauthorized access, data manipulation, and complete compromise of the affected Drupal installation. Attackers can execute arbitrary PHP code on the server, leading to various malicious activities.
To fix this vulnerability, it is recommended to prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files. Additionally, update Drupal core to a fixed version that includes the patched PEAR Archive_Tar library.
Yes, as a temporary workaround, administrators can disable the ability to upload and process .tar, .tar.gz, .bz2, and .tlz files until the Drupal core is updated to a fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
