• Advisory ID: DRUPAL-SA-2006-007
  • Project: Drupal core and potentially any web application that accepts uploads.
  • Date: 2006-Jun-01
  • Security risk: highly critical
  • Impact: Drupal core
  • Exploitable from: remote
  • Vulnerability: Execution of arbitrary files

Description

Recently, the Drupal security team was informed of a potential exploit that would allow untrusted code to be executed upon a successful request by a malicious user. If a dynamic script with multiple extensions such as file.php.pps or file.sh.txt is uploaded and then accessed from a web browser under certain common Apache configurations, it will cause the script inside to be executed. We deemed this exploit critical and released Drupal 4.6.7 and 4.7.1 six hours after the report was filed. The fix was to create a .htaccess file to remove all dynamic script handlers, such as PHP, from the "files" directory.

After continuous review, however, we've found that the fix will not work in certain Apache configurations, for example those for whom .htaccess FileInfo overrides are disabled. We are thus releasing 4.6.8 and 4.7.2 with a more robust .htaccess fix, as well as a Drupal core solution to the issue which will work under all configurations. The new behavior of Drupal's upload.module is to rename all uploaded files with multiple, non-numeric, and non-whitelisted extensions by any other user than the administrator. For example:

file.php.pps
this is a long file.name.txt

becomes:

file.php_.pps
this is a long file.name_.txt

Please note that the particular Apache configurations under which this exploit is possible will affect ANY web application on the server which allows uploads to web-accessible directories, not just Drupal. The Drupal security team has also contacted other projects, such as WordPress, about this issue and new versions of their software have either already been released, or are forthcoming.

4.7.2 also fixes a potential XSS bug with upload.module.

Versions affected

- All Drupal versions before 4.6.8 and before Drupal 4.7.2.

Solution

If you are running Drupal 4.6.x then upgrade to Drupal 4.6.8.
If you are running Drupal 4.7.x then upgrade to Drupal 4.7.2.
To patch Drupal 4.6.7 use the http://drupal.org/files/sa-2006-007/4.6.7.patch.
To patch Drupal 4.7.1 use the http://drupal.org/files/sa-2006-007/4.7.1.patch.

Reported by

DRUPAL-SA-2006-06 issue: Lourens Veen
XSS vulnerability in upload.module: Karoly Negyesi

Contact

The security contact for Drupal can be reached at security at drupal.org or using the form at http://drupal.org/contact.