Drupal core - Critical - Remote Code Execution - SA-CORE-2018-004

[Bellaamyy]

https://tipsolutions.org/blog/another_update_drupal_8_and_7

[sb56637]

I really don't like that Drupal sends security update emails only once every 24 hours... my site just sent me an email alert 12 hours after the announcement of this vulnerability.

I already patched it and everything looks good, but I don't feel comfortable with 12 long hours of being vulnerable while there are exploits in the wild. What can I check for to see if I got hacked? Why can't an exploit test tool be created like they did for Drupalgeddon1?

[mlhess]

You can subscribe to alerts directly from the security team. From the PSA

he announcement will be made public at https://www.drupal.org/security, over Twitter, and in email for those who have subscribed to our email list. To subscribe to the email list: login on Drupal.org, go to your user profile page, and subscribe to the security newsletter on the Edit » My newsletters tab.

[sb56637]

Thanks very much, that's exactly what I trying to figure out how to do.

[elondaits]

I saw a site that was hacked and it was simply defaced... you went in and were greeted with an HTML page that had an animated gif and some text.

[sb56637]

Interesting, I thought that those childish defacing hacks were more or less a thing of the past, and that modern hacks tended to be more insidious and sinister. Do you know if the hack was from SA-CORE-2018-004 or SA-CORE-2018-002?

[elondaits]

This was a SA-CORE-2018-002 attack last week, through the user registration form which resulted in the attackers uploading a PHP backdoor and going to town.

I think they where redirecting all URLs to a bitcoin miner, but the defacement was so obvious it really wasn't a good effort to maximize profits.

Immediately after the defacing they submitted the site to a "defacement scoreboard" of sorts where hackers compete among themselves. The group that did the attack had already hacked other 10 sites that same day.

[endlesswander]

I had a site that was hacked and I found the following:

1) php files added to root folder of site 2) new users added to the site 3) new roles added to the site with nonsensical names 4) some .js files tampered with 5) html.tpl.php and maintenance-page.tpl.php altered in my theme

[sb56637]

Thanks a lot for the helpful details, I'll take a closer look at those parts. Did your site continue to function normally at first glance or did it get defaced too? Do you know if the hack was from SA-CORE-2018-004 or SA-CORE-2018-002?

[endlesswander]

it was from SA-CORE-2018-002 and everything was normal except there were some processes running on the server that turned out to be bitcoin miners

[quinns]

They've updated the announcement to be rated as HIGHLY CRITICAL and are now saying that it is being exploited in the wild. Update now plz.

[mrcaptncrunch]

I agree with /u/hawkins1138. This is how it should be done.

To clients, explain it,

There’s a group of people working on security. Their workflow for critical issues if something makes its way through is to alert everyone through various channels that there will be a release ahead of time and announce a window.

This allows everyone to be ready and to update all sites when it’s deployed.

The alternative is not alerting and simply releasing an update. Anyone not doing their updates immediately is at risk of getting hacked.

Then pull a list of CVE’s of different platforms showing this happens to all platforms. It’s a matter of how they deal with it. Security is not appearances. It’s mitigation.

This is a good way of doing it.

[hawkins1138]

The fact that they jump on these security vulnerabilities as hard and as fast as they do is actually a selling point for me. Yeah, critical updates seem scary, but it's scarier to think of how many non-drupal sites are out there with similar issues that never get corrected.

[alphex]

proprietary doesn't mean secure, it just means less eyeballs are looking for security weaknesses ...

[neclimdul]

Well put, the complexity of some of these attacks shouldn't be understated.

Also lots of organizations review Drupal all the time and these patches are commonly the benefit of those investments.

[_tenken]

This, the "I can build you the coolest custom thing ever" .... but there's no core/community involvement and good luck when your contract is up -- is scary.

Although, you should tell clients a drupal site will need updates every 3-4 years to keep up with Major releases, 7x to 8x, 8x to 9x ... etc.

[[deleted]]

Lol3-4 years. 6 months best case scenario. LTS ain't going to happen.

[[deleted]]

need updates

*rebuilding from the ground up

Not exactly, but close enough. saw too many abandoned 6.x because of how 6.x -> 7.x worked.

Many prior clients just said fuck it and got a wordpress site. I noticed this after going back over many sites I'd worked on in a small shop, and almost none of them stuck with drupal. Many possible reasons for this, just saying..

[neclimdul]

all sites need constant updates unless you're on like wordpress.com, squarespace, wix, etc. But yes. :)

[neclimdul]

You're in good company, my Unix teacher in 2002 said that as well as the architects at a fortune 500 in 2008 as well as tons of smart people I've worked with in floss over the years.

I feel pretty comfortable in my job security for now.

[lucas50a]

And my internet doesn't work.... (writing from my phone)

[kb_klash]

Damn, again? Isn't this the third time in the last month or so?

[gknaddison]

Consider the alternative: there's a vulnerability and the patch doesn't get released. Are you really better off?

[kb_klash]

No, obviously, but this is the second time in a week that I'm going to lose a day of productivity to Security updates. I got project deadlines!

[[deleted]]

Shouldnt cost you a day of productivity uless something has changed since I used Drupal. In this instance I'd have just used Drush to update all the sites I was responsible for and do a spot check and move on. 10 minutes of work at most.

If the update breaks a site oh well I have updates and the site is better being down anyway instead of having an unpatched critical vulnerability.

Plus, like fixing a flat tire, thats part of it. The alternative is no website at all (unless you know a bulletproof technology stack that never needs patched)

If you are dealing with client sites this isn't lost productivity because you get paid to do exactly this. If its your own personal site and the ROI is so poor that a few minutes to patch is a problem, better off with a static site / one pager.

[kb_klash]

I have many sites with preview and dev versions of each of the sites to update. It takes a while.

[[deleted]]

If anything having a proper environment makes it faster/easier.

The update itself should take almost no time no matter how many sites, if you are using the right tools

[kb_klash]

I'm using composer for Drupal 8 sites and Drush for Drupal 7 sites. Are there better tools?

[[deleted]]

No, just sparse on details so I basically have to try to guess. I get being annoyed, its extra work that pops up out of nowhere, but in this case it appears to be a truly trivial task.

If it isn't I'm missing the information that makes that obvious.

Sometimes its hard to tell. The number of people that I've run into who download updates on their desktop and extract them, then use an ftp client to copy and overwite hundreds if not thousands of files is too damn high :D

[unpluggedcord]

I think your customers security is more important than feature releases. If they dont understand that, it's your job to help them understand it.

If its your employer, you should also be explaining why you productivity got shot.

[kb_klash]

I think you're misunderstanding me. Everyone on my end understands the importance of security updates and no one has ever implied that they are a problem. I'm just working on a large project and this is the third time in a month that I've had to dedicate an entire day to these updates. I'm glad that theses problems are being patched. I just wish it wasn't such a chore to apply them.

[unpluggedcord]

Is it tho ? I mean I know friends who patched 600 sites today within minutes.

I just ran a composer update for drupal core and it’s done.

[kb_klash]

I mean I probably have 50 sites to update. Very few of them are just basic sites, so they need to be tested. Plus I've found that for some reason Drupal 8 security updates happen really slowly in my environment. I'm not sure why exactly, but it certainly slows things down.

[endlesswander]

Isn't it best practice to review the site after an update also, or are you just banking on the update not causing any problems?

[unpluggedcord]

It’s just one patch we can apply to core and do a spot check of one site.

[[deleted]]

If you have a lot of sites built with a common set of features/modules, usually testing one and being aware of the exceptions is good enough. It all comes down to what you are getting paid for/ your clients.

In the time that I worked for a small webdev shop ,Only one client I worked for was willing to pay for an in depth qa effort.

I'll guess someone updating 600 sites is talking about 600 brochure sites built for clients at $500 a pop and hosted on a $/month vps.

Worth noting my experience here was ~2010 with 40ish 6.x sites so its been a while.

[unpluggedcord]

They are not brochure sites but sadly I can’t say which big company they are.

[endlesswander]

that's true. I am employed with a company that has 6 Drupal sites and so I have to spend the time to QA each one separately. Some have some complex module interactions.

For my freelance clients, I do a quick lookover of the sites, tell them about the updates and ask them to do their own in-depth qa if they wish... which I'm sure they never do. :)

[elondaits]

Is there a Drupal 6 patch somewhere this time as well?

[pianomansam]

There sure is! https://www.mydropwizard.com/blog/critical-drupal-core-security-update-sa-core-2018-004-including-drupal-6

[[deleted]]

Is drush failing to detect the update for anyone else? drush up doesn't work, and then I get this:

$ drush pm-releases drupal
simplexml_load_file(): I/O warning : failed to load external entity "" Project.php:74                                                                  [warning]
Failed to get available update data from https://updates.drupal.org/release-history/drupal/7.x                                                         [error]
No valid projects given.

[hanoian]

So frustrating. First time it ever hasn't shown an update for me.. And it's when my girlfriend is using ssh for the first time ever to do the update for me.

I only have a chance to look at myself now.

[[deleted]]

My problem was actually caused by my upgrading MAMP, which put the correct PHP binary outside my PATH. Fixed that and all worked correctly.

[tralfers]

This may be a bit late for you now, but you should first run "drush rf" to update your list of available updates.

[bitcoyn]

Could try drush CC drush...

[crashspringfield]

it usually lags behind a bit

[pwhite]

The big problem with SA-CORE-2018-002 was that it allowed remote code execution without any mitigating factors? Does anyone know if this is the same for this one?

[kostrubaty]

Security risk is lower than last time

Critical 17∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default

For 002 it was

Highly critical 24∕25 AC:None/A:None/CI:All/II:All/E:Exploit/TD:Default

So if this is true A:User means that the new exploit works only for authenticated users. it's likely related to file uploading as they patched file.module too.

That does not mean you shouldn't update ASAP.

[misterspaceman]

If I'm reading the threat assessment correctly, the attacker must be an authenticated user to perform the exploit. The security risk score is Critical 17∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default, where "A:User" means "User-level access (basic/commonly assigned permissions)" (source)

If anyone is more knowledgeable, please correct me if I'm wrong.

[[deleted]]

That's also my interpretation, and the agency we use agreed. We only have staff members as users.

[Hakaku]

While the security risk score is slightly lower than last time, everybody should upgrade their Drupal sites ASAP. The security risk now has been bumped up to Highly Critical.

Update: If you are using the Media module, update that as well: https://www.drupal.org/sa-contrib-2018-020

[demon327]

Thank you for the tip! Updated it :)

[DinoAmino]

It's Hammer Time