Damn! You have to update your Drupal websites.
Yes, of course once again—literally it’s the third time in last 30 days.
As notified in advance two days back, Drupal has now released new versions of its software to patch yet another critical remote code execution vulnerability, affecting its Drupal 7 and 8 core.
Drupal is a popular open-source content management system software that powers millions of websites, and unfortunately, the CMS has been under active attacks since after the disclosure of a highly critical remote code execution vulnerability.
The previously disclosed critical vulnerability, dubbed Drupalgeddon2 (CVE-2018-7600), was patched on March 28, but possibly the changes made to fix this flaw might have opened another critical loophole in the core software, forcing the Drupal team to release a follow-up patch.
According to a new advisory released by the team, the new remote code execution vulnerability (CVE-2018-7602) could also allow attackers to take over vulnerable websites completely.
Since the previously disclosed flaw derived much attention and motivated attackers to target websites running over Drupal, the company has urged all website administrators to install new security patches as soon as possible.
- If you are running 7.x, upgrade to Drupal 7.59.
- If you are running 8.5.x, upgrade to Drupal 8.5.3.
- If you are running 8.4.x, which is no longer supported, you need first to update your site to 8.4.8 release and then install the latest 8.5.3 release as soon as possible.
“We are not aware of any active exploits in the wild for the new vulnerability,” a drupal spokesperson told The Hacker News. “Moreover, the new flaw is more complex to string together into an exploit.”
It should also be noted that the new patches will only work if your site has already applied patches for Drupalgeddon2 flaw.
Technical details of the flaw have not been released in the advisory, but that does not mean you can wait until next morning to update your website, believing it won’t be attacked.
We have seen how attackers developed automated exploits leveraging Drupalgeddon2 vulnerability to inject cryptocurrency miners, backdoors, and other malware into websites, within few hours after it’s detailed went public.
Besides these two flaws, the team also patched a moderately critical cross-site scripting (XSS) vulnerability last week, which could have allowed remote attackers to pull off advanced attacks including cookie theft, keylogging, phishing and identity theft.
Therefore, Drupal website admins are highly recommended to update their websites as soon as possible.
- Over 115,000 Drupal Sites Still Vulnerable to Drupalgeddon2 Exploit
- Another Critical Flaw Found In Drupal Core—Patch Your Sites Immediately
- Hackers Have Started Exploiting Drupal RCE Exploit Released Yesterday
- Release of PoC Exploit for New Drupal Flaw Once Again Puts Sites Under Attack
- Symfony Flaw Leaves Drupal Sites Vulnerable to Hackers—Patch Now