The unseen Drupal

Drupal is an open-source content management framework written in PHP with a robust back-end framework. The Drupal framework is being used by applications ranging from blogs to government websites. The features of Drupal include user account registration and maintenance, menu management, RSS feeds, taxonomy, page layout customisation, and system administration. Drupal supports easy content authoring, excellent security, reliable performance, modularity and many more. The latest version Drupal 8 has advantageous technical features like built-in support for responsive themes, support for 200 languages and many more. These features have helped Drupal users to create a stunning web application. However, with these features, comes bugs and vulnerabilities that can have significant impacts on the web applications based on Drupal. Many versions of Drupal are vulnerable to attacks like remote code execution, cross-site scripting and many more.

Vulnerabilities in Drupal can arise due to the following:-

• Drupal Version: Each version of Drupal fixes bugs and introduces new features for the developers. If a developer uses an older version of Drupal, he might be vulnerable to attacks based on that version of Drupal. If an attacker knows which version of Drupal a web application is based on, he could attack the application using the vulnerabilities of that Drupal’s version. Older versions of Drupal is vulnerable to attacks like remote code execution, SQL injection and many more. These vulnerabilities are fixed in the latest version of Drupal.

• Drupal Themes: Themes are used to make the Drupal-based application visually appealing and feature rich. These themes can be applied through Drupal. These themes might have bugs that might expose the application to many vulnerabilities. The vulnerable themes can cause attacks like Arbitrary file inclusion, brute force attack, open redirect attack, SQL injection attack and many more.

• Drupal Plugins: Drupal introduced plugin support to improve the features of a web application based on Drupal. There many plugins in Drupal that are vulnerable to attacks like SQL injection, remote file inclusion and many more. Through vulnerable plugins, the attacker can perform attacks that can potentially compromise the application.

Impact

The impact include:-

• Cross-site scripting attacks
• Remote code execution
• SQL injection attacks
• Cache poisoning attacks
• Open redirect attack
• Brute force attack
• Cross-site Request Forgery
• External link injection
• Eval injection

Mitigation / Precaution

According to Beagle, if an application has a vulnerable Drupal:-

• version, update the Drupal to the latest version.
• plugin, update the plugins used in Drupal to the latest version.
• theme, update the theme used in Drupal to the latest version.

Written by

Nash N Sulthan

Cyber Security Lead Engineer