CVE-2018-7602 (SA-CORE-004) #Drupalgeddon3 about drupalgeddon2 HOT 6 CLOSED

This is another vulnerability... So this project wouldn't be "Drupalgeddon2" if it was added ;).
I've seen the PoC on EDB/Pastebin, but haven't yet tested it.

Views @dreadlocked? Should/could it be added!

from drupalgeddon2.

just got my hands on the exploit for the "Drupalgeddon3", it seems like you need to be authenticated in order to have success with this bug which makes it less interesting. If it really needs authentification, I wonder why Drupal flags it as "highly critical" and states that hackers are already exploiting this bug in the wild.

from drupalgeddon2.

exploit syntax would be:

url+"/?q=node/1/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami"

so far all tests are asking for auth users in order to show the content of this page. Maybe we can find another end point to bypass the required auth?

from drupalgeddon2.

Yeah, maybe we can add SA-CORE-004 compatibility, few more arguments needed, like a cookie (It's an authenticated RCE) and form CSRF (can be extracted automatically).

I'll test the PoC this weekend, and if it's reliable, add it.

from drupalgeddon2.

i would suggest if you have the time do a signup to the target in order to get authenticated or something, else it's useless

from drupalgeddon2.

Closing this, as its out of scope in my eyes.

from drupalgeddon2.