CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Description
CVE-2018-7600 is a CRITICAL remote code execution vulnerability in Drupal Core with a CVSS 3.1 score of 9.8, widely known as "Drupalgeddon 2." The vulnerability allows unauthenticated remote attackers to execute arbitrary code on vulnerable Drupal installations by exploiting insufficient input validation in the Form API rendering subsystem. Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 are affected. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.94489 (99.999th percentile) confirms near-universal exploitation and demands the highest priority for remediation. This vulnerability has been associated with ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| drupal | drupal | <= 7.57; >= 8.0.0, < 8.3.9; >= 8.4.0, < 8.4.6; >= 8.5.0, < 8.5.1 |
| debian | debian linux | 7.0; 8.0; 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/103534(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040598(Broken Link, Third Party Advisory, VDB Entry)
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/(Broken Link, Third Party Advisory)
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714(Third Party Advisory)
- https://github.com/a2u/CVE-2018-7600(Third Party Advisory)
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE(Patch, Third Party Advisory)
- https://greysec.net/showthread.php?tid=2912&pid=10561(Broken Link, Issue Tracking, Third Party Advisory)
- https://groups.drupal.org/security/faq-2018-002(Vendor Advisory)
- https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html(Third Party Advisory)
- https://research.checkpoint.com/uncovering-drupalgeddon-2/(Exploit, Third Party Advisory)
- https://twitter.com/RicterZ/status/979567469726613504(Broken Link, Third Party Advisory)
- https://twitter.com/RicterZ/status/984495201354854401(Broken Link, Third Party Advisory)
- https://twitter.com/arancaytar/status/979090719003627521(Third Party Advisory)
- https://www.debian.org/security/2018/dsa-4156(Third Party Advisory)
- https://www.drupal.org/sa-core-2018-002(Vendor Advisory)
- https://www.exploit-db.com/exploits/44448/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/44449/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/44482/(Exploit, Third Party Advisory, VDB Entry)
- https://www.synology.com/support/security/Synology_SA_18_17(Third Party Advisory)
- https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2018-7600 is classified under CWE-20 — Improper Input Validation. This weakness occurs when software does not properly validate input data before processing it, allowing attackers to craft malicious inputs that alter program behavior in unintended ways. Improper input validation is one of the most prevalent root causes of security vulnerabilities, enabling injection attacks, buffer overflows, and logic manipulation.
In the context of Drupal Core, the Form API rendering subsystem failed to sufficiently sanitize input passed through form element properties. Attackers could inject specially crafted data into Drupal form rendering callbacks, bypassing security layers that normally prevent code execution. Because the vulnerable code path was accessible without authentication through default module configurations, the attack surface was extremely broad. Over 100,000 Drupal sites were estimated to be vulnerable, making this one of the most impactful CMS vulnerabilities ever disclosed.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2018-7600 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants full read access to all data on the compromised Drupal server, including database credentials, user records, session tokens, and any sensitive content stored within the CMS or accessible from the server.
Integrity (HIGH): Attackers can modify any data on the Drupal installation, including defacing website content, injecting malicious scripts into pages served to visitors, altering database records, and installing persistent backdoors for long-term access.
Availability (HIGH): Complete disruption of the Drupal service is possible, including taking the site offline, encrypting files for ransomware, corrupting the database, or using the server resources for cryptomining or as a botnet node.
With an EPSS score of 0.94489 (99.999th percentile), CVE-2018-7600 represents one of the most actively exploited vulnerabilities in existence. Automated exploitation tools were released within days of disclosure, and mass scanning campaigns targeted vulnerable Drupal installations globally.
Exploit Maturity
CVE-2018-7600 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Multiple public exploits are readily available, including proof-of-concept code on GitHub and entries in Exploit-DB. Exploitation was observed within days of the initial advisory, and automated scanning tools quickly incorporated the vulnerability. The exploit requires only a single HTTP request to achieve remote code execution.
Ransomware association: This vulnerability has been confirmed as associated with ransomware campaigns. Threat actors have leveraged CVE-2018-7600 to gain initial access to Drupal servers, subsequently deploying ransomware payloads to encrypt site data and demand payment.
Attack surface: The vulnerability is trivially exploitable with widely available tools. Metasploit modules exist for automated exploitation. The attack requires no authentication, no user interaction, and works against default Drupal configurations. The EPSS score of 0.94489 (99.999th percentile) places this among the most exploited vulnerabilities ever tracked.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Any unpatched Drupal installation should be considered likely compromised.
Remediation
- Update Drupal Core immediately. Upgrade to Drupal 7.58, 8.3.9, 8.4.6, 8.5.1, or later. Consult the official Drupal security advisory at SA-CORE-2018-002 for version-specific guidance.
- Identify all Drupal installations in your environment. Use asset discovery tools to locate every Drupal instance, including development, staging, and forgotten installations. Affected versions include Drupal 7.x before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1.
- Assume compromise if patching was delayed. Given that automated exploitation began within days of disclosure, any Drupal installation that was not patched promptly should be forensically examined for indicators of compromise, including web shells, modified files, and unauthorized database changes.
- Implement web application firewall rules. Deploy WAF rules to block exploitation attempts targeting Drupal Form API vulnerabilities as an additional layer of defense.
- Review server access logs for exploitation indicators. Look for unusual POST requests to Drupal form endpoints, unexpected file creation in the webroot, and signs of reconnaissance activity.
- Harden Drupal security configuration. Disable unnecessary modules, restrict file permissions, implement security headers, and ensure regular backup procedures are in place to minimize impact from future vulnerabilities.
Technical Details
CVE-2018-7600 is a CRITICAL vulnerability in Drupal Core exploitable remotely over the network without authentication or user interaction. The attack complexity is low, requiring no specialized conditions.
Technical mechanism: The vulnerability exists in Drupal's Form API (FAPI) rendering subsystem, which processes form element arrays (render arrays). Drupal's rendering engine accepts nested arrays describing page elements, but certain properties within these arrays can trigger callbacks during the rendering process. An attacker can inject malicious data into form element properties that are processed by render callbacks, achieving code execution. The flaw affects multiple subsystems because the render array processing is a core architectural pattern used throughout Drupal.
Attack flow: The attacker sends a specially crafted HTTP POST request to a Drupal form endpoint (commonly the user registration form at /user/register). The payload manipulates form element properties to inject shell commands into render callbacks. When Drupal processes the form submission and renders the response, the injected commands are executed with the privileges of the web server process.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): Network-accessible, low complexity, no privileges required, no user interaction needed. The Unchanged scope means exploitation is confined to the Drupal server, but the HIGH impact across all three CIA dimensions reflects complete system compromise.
Affected products: Drupal (<= 7.57), Drupal (>= 8.0.0, < 8.3.9), Drupal (>= 8.4.0, < 8.4.6), Drupal (>= 8.5.0, < 8.5.1), Debian Linux (7.0, 8.0, 9.0).
Frequently Asked Questions
Is CVE-2018-7600 being actively exploited?
Yes, CVE-2018-7600 is one of the most actively exploited CMS vulnerabilities in history. It was added to CISA's KEV catalog and has an EPSS score of 0.94489 (99.999th percentile), confirming near-universal exploitation. Automated exploit tools appeared within days of disclosure, and mass exploitation campaigns have targeted Drupal sites globally. The vulnerability has also been linked to ransomware campaigns.
What products are affected by CVE-2018-7600?
Drupal Core versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 are affected. Debian Linux versions 7.0, 8.0, and 9.0 that shipped with vulnerable Drupal packages are also impacted. Any website running an unpatched Drupal installation is at risk.
How do I fix CVE-2018-7600?
Update Drupal Core to the latest patched version (7.58+, 8.3.9+, 8.4.6+, or 8.5.1+). If patching was delayed after the March 2018 disclosure, conduct a forensic review of the server for signs of compromise. Deploy WAF rules, review access logs, and consider rebuilding the server from a known-clean backup if compromise is suspected.
How severe is CVE-2018-7600?
CVE-2018-7600 is rated CRITICAL with a CVSS score of 9.8 out of 10. It allows unauthenticated remote code execution with no user interaction required. Its EPSS score of 0.94489 (99.999th percentile) makes it one of the most likely-to-be-exploited vulnerabilities tracked. It has confirmed ransomware associations and CISA set a remediation deadline of 2022-05-03.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.