Drupal fixes critical Remote Code Execution vulnerability, patch now

Drupal, a popular CMS and blogging platform has patched a remote code execution vulnerability, CVE-2020-13671.

Today, over half a million sites use Drupal, as such applying updates for critical vulnerabilities like these immediately is vital.

The vulnerability also tracked as SA-CORE-2020-012, exists due to improper validation of filenames of files uploaded to Drupal websites.

A remote attacker can upload files with crafted filenames. Since the vulnerable versions do not properly sanitize these filenames, it is possible to trick the uploader into treating a file as, say, PHP, and have it execute arbitrary code on the server.

“Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations,” states Drupal’s security advisory.

Multiple patched versions released

Drupal has released patches for multiple versions, depending on what branch you are using:

• If you are using Drupal 9.0, update to Drupal 9.0.8
• If you are using Drupal 8.9, update to Drupal 8.9.9
• If you are using Drupal 8.8 or earlier, update to Drupal 8.8.11
• If you are using Drupal 7, update to Drupal 7.74

“Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage,” states the advisory.

In addition, for due diligence, website admins should check all previously uploaded files for malicious extensions.

The security advisory suggests looking for files with more than one extension, such as filename.php.txt or filename.html.gif.

These files are really PHP or HTML files containing code but have been disguised as text/image files via a misleading file extension.

“Look specifically for files that include more than one extension, like filename.php.txt or filename.html.gif, without an underscore (_) in the extension. Pay specific attention to the following file extensions, which should be considered dangerous even when followed by one or more additional extensions:”

• phar
• php
• pl
• py
• cgi
• asp
• js
• html
• htm
• phtml

“This list is not exhaustive, so evaluate security concerns for other unmunged extensions on a case-by-case basis.”

Multiple researchers have been credited for reporting this vulnerability: ufku, Mark Ferree, Frédéric G. Marand, Samuel Mortenson of the Drupal Security Team, and Derek Wright.

Users are advised to upgrade their Drupal instances to the fixed versions as soon as possible. Also, remember to perform additional auditing steps mentioned above to minimize the possibility of a potential security compromise.