PT-2022-3918 · Drupal · Drupal

Elar Lang · Published 2022-07-20 · Updated 2024-03-06 · CVE-2022-25277

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Drupal core versions 7, 9.3, and 9.4

Description The issue arises from the incorrect interaction between two protections in Drupal core: one that sanitizes filenames with dangerous extensions upon upload and another that strips leading and trailing dots from filenames to prevent uploading server configuration files. If a site is configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized, potentially allowing bypassing of the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This is mitigated by the requirement for a field administrator to explicitly configure a file field to allow htaccess as an extension or for a contributed module or custom code to override allowed file uploads.

Recommendations For Drupal core version 7: Update to version 7.91. For Drupal core version 9.3: Update to version 9.3.19. For Drupal core version 9.4: Update to version 9.4.3. As a temporary workaround, consider restricting the upload of files with an htaccess extension until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

BDU:2022-04741

BIT-DRUPAL-2022-25277

CVE-2022-25277

DRUPAL-CORE-2022-014

GHSA-6955-67HM-VJJQ

Affected Products

Drupal

References · 16

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25277 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25277 · Security Note
• https://drupal.org/sa-core-2022-014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04741 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25277 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25277 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6955-67hm-vjjq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25277 · Security Note
• https://osv.dev/vulnerability/BIT-drupal-2022-25277 · Vendor Advisory
• https://github.com/drupal/core · Note
• https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17 · Note
• https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a · Note
• https://t.me/cvenotify/49110 · Telegram Post
• https://t.me/cibsecurity/62896 · Telegram Post