Drupal, the popular Content Management System, (might) have seen better days. There's been a lot of attention to it lately in regards to a nasty Remote Code Execution (RCE) vulnerability. In particular a number of builds in the 7.x and 8.x family of Drupal versions allowed unauthenticated RCE which could lead to full system compromise.
Drupal came up with security advisories (SA-CORE-2018-002 / CVE-2018-7600) and patches for the vulnerability. Users that haven't upgraded yet are highly recommended to do so as public exploits came out a few weeks ago. There has been somewhat widespread compromise of unpatched systems to setup backdoors, take over websites and spread cryptocurrency miners.
SpiderLabs Commercial Rules subscribers have had protections in place since the day that this vulnerability became widely public and the rules are being updated to account for new findings and exploits in the wild.
Recently, further developments into other methods to achieve RCE were uncovered. Drupal released advisory SA-CORE-2018-004 with updated versions and patches to fix the newly identified flaws.
An analysis of public exploits shows that the Form API is still being targeted. The PoCs exploit the "destination" parameter of a URL that is loaded when an authenticated user initiates a request to delete a post, topic or any other nodes. As this parameter also allows other URLs within its own unsanitized parameters, it eventually allows an attacker to trick Drupal into executing code.
In addition, the stripDangerousValues() function that should filter "dangerous" characters (such as "#") can be bypassed by using the Unicode representation of the "#" character ("%2523"). This is then decoded by the application as "#" leading to the vulnerability described on SA-CORE-2018-002 ( CVE-2018-7600) which allows arbitrary code execution. Again, users that haven't upgraded yet are highly recommended to do so:
It's worth noting that this time it took only a few hours for attackers to target and attack vulnerable Drupal installations. Widespread compromise of unpatched systems to setup backdoors, take over websites and spread cryptocurrency miners are to be expected.
The SpiderLabs WAF Research team quickly made sure that the Commercial Rules covers the recently disclosed vulnerability SA-CORE-2018-004 ( CVE-2018-7602) dubbed "Drupalgeddon3" and updates are already available for Commercial Rules subscribers.
