Drupal core Remote Code Execution Vulnerability
Summary
GHSA-jf8c-36vw-98x4: Drupal core Remote Code Execution. Affects drupal/drupal across 3 version ranges.
>= 7.0, < 7.60
>= 8.0.0, < 8.5.8
>= 8.6.0, < 8.6.2
Fixed in 7.60, 8.5.8 or 8.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It is widely used for building websites and applications. The vulnerability in Drupal core allows for remote code execution when sending email. This vulnerability arises due to the lack of sanitization of certain variables in the DefaultMailSystem::mail() function. An attacker could exploit this vulnerability to execute arbitrary code on the affected Drupal installation.
Vulnerability Detail
The vulnerability in Drupal core arises from the improper sanitization of variables used in the DefaultMailSystem::mail() function. When sending email, certain variables are not properly sanitized for shell arguments. This allows an attacker to inject malicious code into the email parameters, leading to remote code execution. The impact of this vulnerability is severe as it allows an attacker to gain unauthorized access to the affected Drupal installation and potentially compromise the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.607.60composer require drupal/drupal:7.60 -
>= 8.0.0, < 8.5.88.5.8composer require drupal/drupal:8.5.8 -
>= 8.6.0, < 8.6.28.6.2composer require drupal/drupal:8.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions of Drupal core as soon as possible to address the issue.
Conclusion
The vulnerability in Drupal core that allows for remote code execution is a critical issue that needs to be addressed promptly. Updating to the fixed versions of Drupal core is crucial to mitigate the risk of unauthorized access and potential compromise of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It is widely used for building websites and applications.
Remote code execution refers to the ability of an attacker to execute arbitrary code on a target system remotely, without having physical access to the system.
This vulnerability can be exploited by an attacker who can send email using the affected Drupal installation. By injecting malicious code into the email parameters, the attacker can execute arbitrary code on the target system.
The impact of this vulnerability is severe as it allows an attacker to gain unauthorized access to the affected Drupal installation and potentially compromise the entire system.
The only known mitigation for this vulnerability is to update the Drupal core to the fixed versions mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
