SoylentNews is people
SoylentNews
Submission Preview
Drupal Remote Code Execution Vulnerability Exploited Widely
COLLECTED BY Arthur Bot - NEEDS EDITING
Drupal has had a bad first half of 2018 regarding security. Following Drupalgeddon 2 and the botnet exploits [drupal.sh] came a smaller update. This is now followed with a critical vulnerability (SA-CORE-2018-004) that allows remote code execution. The commit showing the made patches to Drupal 8.x is available online: 7bff52b3a15d [github.com]
The flaw exists in the Drupal core package in all supported versions of Drupal, eg. 7.x and 8.x releases. This vulnerability allows attackers to exploit Drupal powered sites from numerous attack vectors. The end result being the site compromised as remote code can be executed, possibly giving unrestricted control to the hosting environment.
To make matters worse for Drupal security record, the vulnerability is being actively exploited hours after the patch was released by the Drupal core team. Regardless of how well the security team has worked to reveal these, it's up to the community of users using Drupal to upgrade.
All in all the string of vulnerabilities in Drupal makes a dent in the reputation of Drupal. Earlier in 2015 the Drupalgeddon vulnerability played a part in the Panama Papers leak [drupal.sh] and Cambridge Analytica [drupal.sh] also continues to run vulnerable Drupal.
Nowadays Drupal is mostly marketed as a robust enterprise tool going head-to-head against SharePoint [drupal.sh] for markets where it holds critical data. With the codebase being shown to be exploitable week after week, it's questionable if it can be considered as a tool to hold sensitive data at all - especially when left unmaintained.
Especially as GDPR regulations safe guarding privacy come into play. As a result, large enterprises using Drupal could end up paying fines up to 20 Million euros for using an unsecured Drupal installation. The price of free, unmaintained Open Source can come at a high price to organisations not competent in maintaining or purchasing maintenance Drupal.
More information on the vulnerability and how to protect from being exploited on Drupal security blog: https://www.drupal.org/sa-core-2018-004 [drupal.org]
The security team is aware that SA-CORE-2018-004, is being exploited in the wild. If you have not updated, please do so now. https://t.co/TVGob2IXvL [t.co]
