Actively exploited · Published Mar 29, 2018 · Assigned by drupal
CVE-2018-7600
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | drupal7 | 7.58-r0 | ALPINE-CVE-2018-7600 |
| Packagist | drupal/core | 8.3.9, 8.4.6, 8.5.1 | DRUPAL-CORE-2018-002 |
| Packagist | drupal/core | 7.58 | GHSA-7fh9-933g-885p |
| Packagist | drupal/core | 8.3.9 | GHSA-7fh9-933g-885p |
| Packagist | drupal/core | 8.4.6 | GHSA-7fh9-933g-885p |
| Packagist | drupal/core | 8.5.1 | GHSA-7fh9-933g-885p |
| Packagist | drupal/drupal | 7.58 | GHSA-7fh9-933g-885p |
| Packagist | drupal/drupal | 8.3.9 | GHSA-7fh9-933g-885p |
| Packagist | drupal/drupal | 8.4.6 | GHSA-7fh9-933g-885p |
| Packagist | drupal/drupal | 8.5.1 | GHSA-7fh9-933g-885p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE x_refsource_MISC
- 1040598 vdb-entry, x_refsource_SECTRACK
- https://twitter.com/arancaytar/status/979090719003627521 x_refsource_MISC
- https://twitter.com/RicterZ/status/979567469726613504 x_refsource_MISC
- https://www.drupal.org/sa-core-2018-002 x_refsource_CONFIRM
- https://www.synology.com/support/security/Synology_SA_18_17 x_refsource_CONFIRM
- https://github.com/a2u/CVE-2018-7600 x_refsource_MISC
- 44482 exploit, x_refsource_EXPLOIT-DB
- https://research.checkpoint.com/uncovering-drupalgeddon-2/ x_refsource_MISC
- https://groups.drupal.org/security/faq-2018-002 x_refsource_CONFIRM
- DSA-4156 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update mailing-list, x_refsource_MLIST
- 44448 exploit, x_refsource_EXPLOIT-DB
- 103534 vdb-entry, x_refsource_BID
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ x_refsource_MISC
- https://greysec.net/showthread.php?tid=2912&pid=10561 x_refsource_MISC
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 x_refsource_MISC
- https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know x_refsource_MISC
- https://twitter.com/RicterZ/status/984495201354854401 x_refsource_MISC
- 44449 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600 government-resource