CVE-2018-7602

What is Drupal Core?

Drupal Core underpins the rendering, forms, and access-control logic used across the whole Drupal CMS ecosystem. Because the same Form API rendering internals implicated in the earlier "Drupalgeddon2" incident touch many different subsystems, a second, related vulnerability surfaced only weeks after the first was patched.

Overview

CVE-2018-7602 ("Drupalgeddon3") is a remote code execution vulnerability affecting multiple subsystems of Drupal Core, closely related to the Form API render-array injection class of bug that produced Drupalgeddon2 a month earlier. The initial SA-CORE-2018-002 fix did not fully close every vector into the same underlying weakness, and Drupal's security team issued a follow-up advisory, SA-CORE-2018-004, to address the remaining exploitable paths. Like its predecessor, it carries a maximum CVSS score of 9.8.

Technical Details

The vulnerability shares its root cause with Drupalgeddon2: Drupal's rendering pipeline can be manipulated through crafted request parameters that are interpreted as render-array properties, some of which resolve to executable callbacks. Where Drupalgeddon2 was reachable via specific unauthenticated forms, Drupalgeddon3 exposed additional code paths — some reachable by users with a valid account and access to certain forms or Views-based functionality — that had not been closed off by the first patch, allowing attackers to again reach the same underlying PHP-callback-injection primitive.

Discovery

The issue was identified by the Drupal Security Team during hardening work that followed the intense public scrutiny of Drupal's Form API rendering internals after Drupalgeddon2, and was fixed via SA-CORE-2018-004 in April 2018.

Exploitation Context

Because Drupalgeddon2 had already put mass-exploitation tooling and technical understanding of Drupal's render-array vulnerability class into wide circulation, Drupalgeddon3 was picked up quickly by the same opportunistic scanning campaigns — cryptomining operators and botnet herders in particular — that had been sweeping the internet for vulnerable Drupal sites throughout 2018. CISA added CVE-2018-7602 to the KEV catalog in April 2022, and the entry notes confirmed use in ransomware campaigns.

Remediation

1. Upgrade Drupal Core to a version incorporating SA-CORE-2018-004 — do not assume the Drupalgeddon2 patch alone is sufficient.
2. Audit any Drupal site patched only for SA-CORE-2018-002 in early-to-mid 2018 for signs of later compromise via this follow-on vector.
3. Keep Drupal Core and all contributed modules current, and subscribe to Drupal's security advisory feed for prompt notification of future issues.
4. Review site user accounts and permissions, since some Drupalgeddon3 vectors required lower-privileged authenticated access — remove unnecessary accounts and roles.
5. Use a web application firewall as defense-in-depth for any legacy Drupal instance that cannot be patched immediately.