Drupal developers have released security updates to address multiple vulnerabilities in the popular CMS:
The US Cybersecurity and Infrastructure Security Agency (CISA) published an advisory for the above vulnerabilities.
The most severe one, rated as “critical,” is an arbitrary PHP code execution tracked as CVE-2022-25277.
“Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010).” reads the advisory. “However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files’ filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core’s default .htaccess files and possible remote code execution on Apache web servers.”
In order to mitigate the issue, it is mandatory for the field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads. The vulnerability impacts 9.4, and 9.3 versions, the advisory states that the issue only affects Apache web servers with specific configurations.
The other three vulnerabilities have been rated as “moderately critical,” that can lead to cross-site scripting (XSS) attacks, information disclosure, or access bypass.
All the issues impact the 9.4, and 9.3 versions, but the information disclosure vulnerability also impacts version 7.
Follow me on Twitter: @securityaffairs and Facebook
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Content Management System, critical code execution flaw)
[adrotate banner=”5″]
[adrotate banner=”13″]
U.S. and U.K. cyber agencies warn that Russia-linked group APT29 is targeting vulnerable Zimbra and…
As Middle East tensions rise, cyberattacks hit Iran’s government branches and nuclear facilities, following Israel's…
Sophos reports ransomware operators are exploiting a critical code execution flaw in Veeam Backup &…
GitLab issued updates for CE and EE to address multiple flaws, including a critical bug…
OpenAI disrupted 20 cyber and influence operations in 2023, revealing Iran and China-linked actors used…
The Internet Archive disclosed a data breach, the security incident impacted more than 31 million…
This website uses cookies.