Arbitrary code execution in Drupal - #VU582

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU582

Arbitrary code execution in Drupal - #VU582

Published: September 21, 2016


Vulnerability identifier: #VU582
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Drupal
Affected software:
Drupal

Detailed vulnerability description

The vulnerability allows a remote user to cause arbitrary code execution on the target system.
The weakness exists due to improper dynamic script handlers. Attackers upload dynamic script with multiple extensions such as file.php.pps or file.sh.txt that if accessed from a web browser causes the internal script execution.
Successful exploitation of the vulnerability allows a malicious user to cause arbitrary code execution on the vulnerable system.

Remediation


Sources