严重 Drupal Drupalgeddon2 远程代码执行（CVE-2018-7600）

CVE编号

CVE-2018-7600

利用情况

EXP 已公开

补丁情况

官方补丁

披露时间

2018-03-29

漏洞描述

Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。 Drupal多个子版本存在远程代码执行漏洞，攻击者可能利用此漏洞实现远程代码执行攻击，从而影响到业务系统的安全性。

解决建议

用户可联系供应商获得补丁信息：https://www.drupal.org/sa-core-2018-002

参考链接
http://www.securityfocus.com/bid/103534
http://www.securitytracker.com/id/1040598
https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon...
https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018...
https://github.com/a2u/CVE-2018-7600
https://github.com/g0rx/CVE-2018-7600-Drupal-RCE
https://greysec.net/showthread.php?tid=2912&pid=10561
https://groups.drupal.org/security/faq-2018-002
https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html
https://research.checkpoint.com/uncovering-drupalgeddon-2/
https://twitter.com/arancaytar/status/979090719003627521
https://twitter.com/RicterZ/status/979567469726613504
https://twitter.com/RicterZ/status/984495201354854401
https://www.debian.org/security/2018/dsa-4156
https://www.drupal.org/sa-core-2018-002
https://www.exploit-db.com/exploits/44448/
https://www.exploit-db.com/exploits/44449/
https://www.exploit-db.com/exploits/44482/
https://www.synology.com/support/security/Synology_SA_18_17
https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	drupal	drupal	*		Up to (including) 7.57
	运行在以下环境
	应用	drupal	drupal	*	From (including) 8.0.0	Up to (excluding) 8.3.9
	运行在以下环境
	应用	drupal	drupal	*	From (including) 8.4.0	Up to (excluding) 8.4.6
	运行在以下环境
	应用	drupal	drupal	*	From (including) 8.5.0	Up to (excluding) 8.5.1
	运行在以下环境
	系统	alpine_3.10	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.11	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.12	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.13	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.14	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.15	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.16	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.17	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.18	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.6	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.7	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.8	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_3.9	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	alpine_edge	drupal7	*		Up to (excluding) 7.58-r0
	运行在以下环境
	系统	debian_7	drupal7	*		Up to (excluding) 7.14-2+deb7u18
	运行在以下环境
	系统	debian_8	drupal7	*		Up to (excluding) 7.32-1+deb8u5
	运行在以下环境
	系统	debian_9	drupal7	*		Up to (excluding) 7.52-2+deb9u3
	运行在以下环境
	系统	fedora_26	drupal8-rpmbuild	*		Up to (excluding) 8.3.9-1.fc26
	运行在以下环境
	系统	fedora_27	drupal8-rpmbuild	*		Up to (excluding) 8.4.6-3.fc27
	运行在以下环境
	系统	fedora_28	drupal8-rpmbuild	*		Up to (excluding) 8.4.6-3.fc28
	运行在以下环境
	系统	fedora_EPEL_6	drupal6	*		Up to (excluding) 6.38-2.el6

阿里云评分 9.4

• 攻击路径 远程
• 攻击复杂度 容易
• 权限要求 无需权限
• 影响范围 全局影响
• EXP成熟度 EXP 已公开
• 补丁情况 官方补丁
• 数据保密性 数据泄露
• 数据完整性 传输被破坏
• 服务器危害 服务器失陷
• 全网数量 N/A

CWE-ID	漏洞类型
CWE-20	输入验证不恰当

Exp相关链接

• https://github.com//pimps/CVE-2018-7600
• https://github.com/a2u/CVE-2018-7600
• https://github.com/cved-sources/cve-2018-7600
• https://github.com/Damian972/drupalgeddon-2
• https://github.com/dr-iman/CVE-2018-7600-Drupal-0day-RCE
• https://github.com/dreadlocked/Drupalgeddon2
• https://github.com/drugeddon/drupal-exploit
• https://github.com/dwisiswant0/CVE-2018-7600
• https://github.com/FireFart/CVE-2018-7600
• https://github.com/fyraiga/CVE-2018-7600-drupalgeddon2-scanner
• https://github.com/g0rx/CVE-2018-7600-Drupal-RCE
• https://github.com/happynote3966/CVE-2018-7600
• https://github.com/Hestat/drupal-check
• https://github.com/jirojo2/drupalgeddon2
• https://github.com/Jyozi/CVE-2018-7600
• https://github.com/knqyf263/CVE-2018-7600
• https://github.com/lorddemon/drupalgeddon2
• https://github.com/ludy-dev/drupal8-REST-RCE
• https://github.com/madneal/codeql-scanner
• https://github.com/madneal/drupalgeddon2
• https://github.com/pimps/CVE-2018-7600
• https://github.com/r3dxpl0it/CVE-2018-7600
• https://github.com/rabbitmask/CVE-2018-7600-Drupal7
• https://github.com/ruthvikvegunta/Drupalgeddon2
• https://github.com/Sch01ar/CVE-2018-7600
• https://github.com/shellord/CVE-2018-7600-Drupal-RCE
• https://github.com/shellord/Drupalgeddon-Mass-Exploiter
• https://github.com/sl4cky/CVE-2018-7600
• https://github.com/sl4cky/CVE-2018-7600-Masschecker
• https://github.com/thehappydinoa/CVE-2018-7600
• https://github.com/vulhub/vulhub/tree/master/drupal/CVE-2018-7600
• https://github.com/ynsmroztas/drupalhunter
• https://github.com/zhzyker/CVE-2018-7600-Drupal-POC-EXP
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/drupal_drupalgeddon2.rb
• https://www.exploit-db.com/exploits/44448
• https://www.exploit-db.com/exploits/44449
• https://www.exploit-db.com/exploits/44482
• https://www.hackthebox.eu/home/machines/profile/146
• https://www.hackthebox.eu/home/machines/profile/7

- avd.aliyun.com