A critical one and three "moderately critical" vulnerabilities found in Drupal 7 and 8

Project: Drupal core
Version: 8.8.x-dev, 8.7.x-dev, 7.x-dev
Date: 2019-December-18
Security risk: Critical 17∕25 
Vulnerability: Multiple vulnerabilities

Drupal Security team released important security updates for Drupal 7 and Drupal 8 which address a critical and three "moderately critical" vulnerabilities in its core system.

Considering that Drupal-powered websites are among the all-time favorite targets for hackers, the website administrators are highly recommended to install the latest release Drupal 7.69, 8.7.11, or 8.8.1 to prevent remote hackers from compromising web servers.

Critical Vulnerability in Drupal

The only advisory with critical severity includes patches for multiple vulnerabilities in a third-party library, called 'Archive_Tar,' that Drupal Core uses for creating, listing, extracting, and adding files to tar archives.

The vulnerability resides in the way the affected library untar archives with symlinks, which, if exploited, could allow an attacker to overwrite sensitive files on a targeted server by uploading a maliciously crafted tar file.

Due to this, to be noted, the flaw only affects Drupal websites that are configured to process .tar, .tar.gz, .bz2, or .tlz files uploaded by untrusted users.

A proof-of-concept exploit for this vulnerability reported as already exists and considering the popularity of Drupal exploits among hackers, you may see hackers actively exploiting this flaw in the wild to target Drupal websites.

Moderately Critical Drupal Vulnerabilities

Besides this critical vulnerability, Drupal developers have also patched three "moderately critical" vulnerabilities in its Core software, brief details of which are as follows:

• Denial of Service (DoS): The install.php file used by Drupal 8 Core contains a flaw that can be exploited by a remote, unauthenticated attacker to impair the availability of a targeted website by corrupting its cached data.
• Security Restriction Bypass: The file upload function in Drupal 8 does not strip leading and trailing dot ('.') from filenames, which can be used by an attacker with file upload ability to overwrite arbitrary system files, such as .htaccess to bypass security protections.
• Unauthorized Access: This vulnerability exists in Drupal's default Media Library module when it doesn't correctly restrict access to media items in certain configurations. Thus, it could allow a low-privileged user to gain unauthorized access to sensitive information that is otherwise out of his reach.

Affected website administrators can mitigate the access media bypass vulnerability by unchecking the "Enable advanced UI" checkbox on /admin/config/media/media-library, though this mitigation is not available in 8.7.x.

All the above "moderately critical" vulnerabilities have been patched with the release of Drupal versions 8.7.11 and 8.8.1, and at the time of writing, no proof-of-concept for these flaws have been made available.

Since a proof-of-concept exists for the critical Drupal vulnerability, users running vulnerable versions of Drupal are highly recommended to update their CMS to the latest Drupal core release as soon as possible.