CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Description
CVE-2018-7602 is a remote code execution vulnerability in Drupal Core, one of the most widely deployed open-source content management systems. Known as part of the "Drupalgeddon" series, this vulnerability allows a remote attacker to exploit an improper input validation flaw to execute arbitrary code on the underlying server. CISA has added CVE-2018-7602 to the Known Exploited Vulnerabilities catalog, confirming widespread active exploitation. With an EPSS score of 97.4% (99.9th percentile), this is among the most exploited vulnerabilities globally, posing an immediate risk to any organization running unpatched Drupal installations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| drupal | drupal | >= 7.0, < 7.59; >= 8.4.0, < 8.4.8; >= 8.5.0, < 8.5.3 |
| debian | debian linux | 7.0; 8.0; 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/103985(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040754(Broken Link, Third Party Advisory, VDB Entry)
- https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html(Mailing List, Third Party Advisory)
- https://www.debian.org/security/2018/dsa-4180(Third Party Advisory)
- https://www.drupal.org/sa-core-2018-004(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/44542/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/44557/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CWE-20 describes a weakness where software receives input or data but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly. In CVE-2018-7602, Drupal Core fails to adequately validate certain user-supplied input, allowing an attacker to inject and execute arbitrary PHP code through the CMS rendering pipeline.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2018-7602 enables remote code execution on the web server hosting Drupal, with the attacker's code running at the privilege level of the web server process. The confidentiality impact is critical — attackers can read the Drupal database credentials, access all stored content, user accounts, and any data accessible from the web server. The integrity impact is equally devastating, as attackers can modify website content, inject malicious scripts for visitor compromise, alter database records, or deploy web shells for persistent access. Availability is fully at risk through potential ransomware deployment, server destruction, or use of the compromised server as part of a botnet. The EPSS score of 97.4% (99.9th percentile) and KEV listing confirm this is one of the most actively targeted web application vulnerabilities.
Exploit Maturity
CVE-2018-7602 is actively exploited in the wild, confirmed by CISA in the Known Exploited Vulnerabilities catalog. The EPSS score of 97.4% (99.9th percentile) places it among the most certain-to-be-exploited vulnerabilities tracked globally. Public exploit code is widely available, including integration into automated exploitation frameworks, and mass scanning campaigns continuously target Drupal installations. The "Drupalgeddon" vulnerability series has been extensively weaponized by cybercriminal groups for cryptomining, ransomware, and web defacement campaigns.
Remediation
- Apply Drupal security patches immediately as required by CISA KEV: update Drupal 7 to version 7.59 or later, and Drupal 8 to version 8.5.3 or later.
- If immediate patching is not possible, consider taking the Drupal site offline until patches can be applied, given the severity and ease of exploitation.
- Audit the Drupal installation for indicators of compromise, including unauthorized PHP files, web shells, modified .htaccess files, new administrator accounts, and unexpected database changes.
- Review web server access logs for patterns consistent with Drupalgeddon exploitation attempts, including unusual POST requests to Drupal form endpoints.
- After patching, implement a web application firewall (WAF) with Drupal-specific rulesets and enable Drupal's security advisory notification system to receive timely alerts about future vulnerabilities.
Technical Details
CVE-2018-7602 is a remote code execution vulnerability in Drupal Core stemming from improper input validation in the CMS's form API and rendering subsystem. The vulnerability is related to CVE-2018-7600 (Drupalgeddon 2) and exploits a different code path to achieve the same result: arbitrary PHP code execution on the server. An attacker can craft HTTP requests that exploit the form processing logic to inject PHP code that is evaluated during page rendering. The attack can be performed with varying levels of authentication depending on the Drupal configuration, but the most common exploitation path requires minimal or no authentication. The vulnerability affects both Drupal 7 and Drupal 8 branches, impacting a massive global installed base.
Frequently Asked Questions
Is CVE-2018-7602 being actively exploited?
Yes. CVE-2018-7602 is one of the most actively exploited web application vulnerabilities, listed in the CISA KEV catalog with an EPSS score of 97.4% (99.9th percentile). Automated scanning and exploitation tools continuously target Drupal installations worldwide.
What products are affected by CVE-2018-7602?
CVE-2018-7602 affects Drupal Core versions prior to 7.59 (Drupal 7) and prior to 8.5.3 (Drupal 8). All Drupal installations running vulnerable versions are at risk of remote code execution.
How do I fix CVE-2018-7602?
Update Drupal 7 to version 7.59+ and Drupal 8 to version 8.5.3+. If patching is not immediately possible, take the site offline. After patching, audit for web shells and unauthorized modifications.
How severe is CVE-2018-7602?
CVE-2018-7602 is a critical remote code execution vulnerability in one of the most popular CMS platforms. Its 99.9th percentile EPSS score confirms near-certain exploitation, and it has been extensively weaponized by cybercriminal groups for various malicious campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.