CVE-2018-7600

What is Drupal Core?

Drupal is one of the most widely used open-source content management systems on the web, powering everything from personal blogs to large government and enterprise sites. Because Drupal Core handles rendering, form processing, and user input across an enormous installed base, a pre-authentication remote code execution bug in the core rendering pipeline represents one of the highest-impact classes of vulnerability a CMS can have.

Overview

CVE-2018-7600, widely known as "Drupalgeddon2," is a critical pre-authentication remote code execution vulnerability in Drupal Core's Form API. By submitting specially crafted keys and values in an HTTP request, an unauthenticated attacker can inject render-array metadata that Drupal's rendering system misinterprets as executable PHP callbacks, ultimately allowing arbitrary PHP code — and therefore full command execution — on the underlying server. With a CVSS score of 9.8 and no authentication or user interaction required, Drupalgeddon2 is one of the most severe and consequential CMS vulnerabilities ever disclosed.

Technical Details

The root cause is CWE-20 (Improper Input Validation): Drupal's Form API allows certain request parameters to be interpreted as "render array" properties (keys beginning with #), some of which map to callback functions executed by Drupal's rendering engine. Because several exposed, unauthenticated endpoints (such as the user registration and password reset forms) process attacker-supplied input through this rendering path without adequately restricting which properties can be set, an attacker can smuggle in a #post_render or similar callback property pointing to a dangerous PHP function, achieving code execution with a single crafted HTTP request — no valid user account, session, or CSRF token required.

Discovery

The vulnerability was discovered and responsibly disclosed to the Drupal Security Team, with the fix credited in part to security researcher Jasper Mattsson. Drupal published advisory SA-CORE-2018-002 and released patched versions in March 2018, ahead of full technical details being made public to give administrators time to patch.

Exploitation Context

Once technical write-ups and working proof-of-concept exploits appeared publicly in April 2018 — roughly two weeks after the patch — mass, automated exploitation began almost immediately across the internet. Attackers used Drupalgeddon2 to deploy cryptocurrency miners, recruit vulnerable servers into DDoS botnets, and in some cases achieve full site takeover, with waves of scanning continuing for years against unpatched installations. CISA added CVE-2018-7600 to the KEV catalog in November 2021, and the entry notes confirmed use in ransomware operations as well.

Remediation

1. Upgrade Drupal Core immediately to a version incorporating SA-CORE-2018-002 (Drupal 7.58, 8.3.9, 8.4.6, or 8.5.1, or later supported releases).
2. Treat any Drupal site that was internet-facing and unpatched during 2018 as potentially compromised — search for webshells, unexpected admin accounts, and scheduled cron jobs.
3. Apply Drupal's official patches rather than hand-editing code, since the fix touches multiple core subsystems (Form API, user, and other modules).
4. Keep Drupal Core and all contributed modules on a current, actively maintained release, and subscribe to Drupal security advisories.
5. Deploy a web application firewall with rules targeting known Drupalgeddon2 request patterns as defense-in-depth for legacy installations pending patching.