Drupal Remote Code Execution Vulnerability (CVE-2018-7602)

• Affected software: drupal
• Method: Encode the # in the URL twice to bypass the sanitize() function filtering
• Effect: Arbitrary command execution

Vulnerability Environment

Execute the following command to start the drupal 7.57 environment:

docker-compose up -d

After the environment is started, visit http://your-ip:8081/ and you will see the drupal installation page. Follow the default configuration and proceed with the installation. Since there is no MySQL environment, you can choose the SQLite database during installation.

Vulnerability Reproduction

Refer to the PoC from pimps/CVE-2018-7600.

As shown in the figure below, execute the following command to reproduce the vulnerability. The example command is id, which is displayed in the red box in the figure, indicating that the command can be executed.

# "id" is the command to execute, the first drupal is the username, the second drupal is the password
python3 drupa7-CVE-2018-7602.py -c "id" drupal drupal http://127.0.0.1:8081/