CVE-2020-13671
Drupal core Un-restricted Upload of File
Description
CVE-2020-13671 is a high-severity unrestricted file upload vulnerability in Drupal core. Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or even executed as PHP under certain hosting configurations. An authenticated attacker exploiting this vulnerability could achieve remote code execution on the web server by uploading a malicious file disguised with a manipulated filename. CISA has added CVE-2020-13671 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 4.5% (88.96th percentile), this Drupal vulnerability poses a significant risk to organizations running unpatched Drupal installations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| drupal | drupal | >= 7.0, < 7.74; >= 8.8.0, < 8.8.11; >= 8.9.0, < 8.9.9; >= 9.0.0, < 9.0.8 |
| fedoraproject | fedora | 32; 33 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/(Mailing List, Release Notes)
- https://www.drupal.org/sa-core-2020-012(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
In the context of CVE-2020-13671, Drupal core fails to properly validate and sanitize filenames during file upload operations, allowing attackers to upload files with dangerous extensions that can be executed server-side. This unrestricted file upload weakness enables attackers to bypass intended file type restrictions by crafting filenames that exploit the improper sanitization logic, potentially uploading web shells or other malicious scripts.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2020-13671 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting its severe potential impact. The vulnerability is remotely exploitable over the network with low attack complexity, requiring only low-level authentication and no user interaction. Successful exploitation results in high impact across all three security dimensions: Confidentiality (High) means attackers can access sensitive data stored on the server, Integrity (High) allows unauthorized modification of files and server configurations, and Availability (High) enables attackers to disrupt services or take systems offline. With an EPSS score of 4.5% placing it in the 88.96th percentile, this vulnerability has a notable probability of exploitation. Organizations running affected Drupal versions face the risk of complete server compromise through malicious file uploads that could be executed as PHP code.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-13671 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-07-18. The EPSS score of 4.5% (88.96th percentile) indicates a significant probability of exploitation activity. While no direct public exploit code is tagged in the NVD references, the vulnerability’s nature as a file upload bypass in a widely-deployed CMS makes it straightforward to exploit for attackers with authenticated access. The vendor advisory from Drupal (SA-CORE-2020-012) provides detailed information about the affected functionality.
Remediation
- Apply Drupal security updates immediately as required by CISA KEV: update Drupal Core 9.0 to version 9.0.8 or later, 8.9 to version 8.9.9 or later, 8.8 to version 8.8.11 or later, and Drupal 7 to version 7.74 or later.
- Audit previously uploaded files on your Drupal installations for suspicious filenames or unexpected file extensions, particularly files that could be interpreted as PHP, such as files with double extensions or trailing dots.
- Configure your web server to prevent execution of scripts in upload directories by adding directives that disable PHP execution in
sites/default/files/and other upload paths (e.g., using.htaccessrules for Apache orlocationblocks for Nginx). - Implement file upload validation at the server and application level by maintaining a strict whitelist of allowed file extensions and validating file content using magic bytes rather than relying solely on filename extensions.
- Monitor web server logs for indicators of compromise, including unusual file uploads, unexpected PHP file executions in upload directories, and web shell activity patterns.
Technical Details
CVE-2020-13671 exploits a flaw in Drupal core’s filename sanitization logic during file upload processing. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), where Drupal fails to properly neutralize specially crafted filenames that can bypass extension validation. An attacker with authenticated access (as reflected by the CVSS vector PR:L) can upload a file with a manipulated name that causes the web server to interpret it with an incorrect MIME type or execute it as PHP code. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning no special conditions or race conditions are needed. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that while authentication is required, once the file is uploaded, the impact on confidentiality, integrity, and availability is high, effectively granting the attacker code execution capabilities on the underlying server.
Frequently Asked Questions
Is CVE-2020-13671 being actively exploited?
Yes. CVE-2020-13671 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 4.5% (88.96th percentile) further indicates a notable probability of exploitation. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2020-13671?
CVE-2020-13671 affects Drupal core across multiple major versions: Drupal 9.0 versions prior to 9.0.8, Drupal 8.9 versions prior to 8.9.9, Drupal 8.8 versions prior to 8.8.11, and Drupal 7 versions prior to 7.74. Fedora Linux versions 32 and 33 are also affected through their packaged Drupal installations.
How do I fix CVE-2020-13671?
Update Drupal core to the patched versions: 9.0.8+, 8.9.9+, 8.8.11+, or 7.74+ respectively. After updating, audit any previously uploaded files for potentially malicious content, as attackers may have exploited this vulnerability before the patch was applied. Additionally, configure your web server to prevent script execution in upload directories as a defense-in-depth measure.
How severe is CVE-2020-13671?
CVE-2020-13671 has a CVSS 3.1 score of 8.8 (HIGH). The vulnerability allows authenticated attackers to upload and potentially execute malicious files on the server, which can lead to complete system compromise. Its inclusion in the CISA KEV catalog and EPSS percentile of 88.96% underscore the urgency of remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.