vulnwire
9.8crit

CVE-2018-7600KEV · ransomwarein critical feed4 exploitsNuclei template

Drupal Core Remote Code Execution Vulnerability

Also known as DRUPAL-CORE-2018-002, GHSA-7fh9-933g-885p

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
100.0%
percentile 100%
Public exploits
4
Metasploit · Exploit-DB · Nuclei check

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor / product
Drupal / Drupal Core
CISA name
Drupal Core Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

99.99% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Nuclei template Drupal - Remote Code Execution · nuclei detection template
  • Metasploit exploit/unix/webapp/drupal_drupalgeddon2 Drupal Drupalgeddon 2 Forms API Property Injection · metasploit exploit, excellent rank · 2018-03-28
  • EDB-44482 Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) · remote · 2018-04-17
  • EDB-44449 Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution · webapps · 2018-04-13
  • EDB-44448 Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC) · webapps · 2018-04-13

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=7.0, <7.58
>=8.0, <8.3.9
>=8.4.0, <8.4.6
>=8.5.0, <8.5.1
>=8.0.0, <8.3.9
7.58
8.3.9
8.4.6
8.5.1
packagistdrupal/drupal
>=7.0, <7.58
>=8.0, <8.3.9
>=8.4, <8.4.6
>=8.5, <8.5.1
7.58
8.3.9
8.4.6
8.5.1

Affected products

  • n/a Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • github.com /g0rx/CVE-2018-7600-Drupal-RCE · x_refsource_MISC, x_transferred
  • securitytracker.com /id/1040598 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • twitter.com /arancaytar/status/979090719003627521 · x_refsource_MISC, x_transferred
  • twitter.com /RicterZ/status/979567469726613504 · x_refsource_MISC, x_transferred
  • drupal.org /sa-core-2018-002 · x_refsource_CONFIRM, x_transferred
  • synology.com /support/security/Synology_SA_18_17 · x_refsource_CONFIRM, x_transferred
  • github.com /a2u/CVE-2018-7600 · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/44482/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • research.checkpoint.com /uncovering-drupalgeddon-2/ · x_refsource_MISC, x_transferred
  • groups.drupal.org /security/faq-2018-002 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2018/dsa-4156 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • lists.debian.org /debian-lts-announce/2018/03/msg00028.html · mailing-list, x_refsource_MLIST, x_transferred
  • exploit-db.com /exploits/44448/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /bid/103534 · vdb-entry, x_refsource_BID, x_transferred
  • badpackets.net /over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ · x_refsource_MISC, x_transferred
  • greysec.net /showthread.php?tid=2912&pid=10561 · x_refsource_MISC, x_transferred
  • blog.appsecco.com /remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 · x_refsource_MISC, x_transferred
  • tenable.com /blog/critical-drupal-core-vulnerability-what-you-need-to-know · x_refsource_MISC, x_transferred
  • twitter.com /RicterZ/status/984495201354854401 · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/44449/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600 · government-resource
  • nvd.nist.gov /vuln/detail/CVE-2018-7600 · advisory
  • exploit-db.com /exploits/44482 · web
  • exploit-db.com /exploits/44449 · web
  • exploit-db.com /exploits/44448 · web
  • research.checkpoint.com /uncovering-drupalgeddon-2 · web
  • github.com /drupal/core · package
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml · web
  • badpackets.net /over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.