Drupal disclosed two vulnerabilities in versions 9.2 and 9.3 that could allow an attacker to upload malicious files and take control of a site. The two vulnerabilities are rated as Moderately Critical in terms of the threat level.<\/p>\n\n\n\n
The US Cybersecurity and Infrastructure Security Agency (CISA) warned that the exploits could allow an attacker to take control of a vulnerable Drupal-based website.<\/p>\n\n\n\n
CISA stated:<\/strong><\/p>\n\n\n\n \u201cDrupal has released security updates to address vulnerabilities affecting Drupal 9.2 and 9.3.<\/p> An attacker could exploit these vulnerabilities to take control of an affected system.\u201d<\/p><\/blockquote>\n\n\n\n Drupal is a well-known open-source content management system that is written in the PHP programming language.<\/p>\n\n\n\n Drupal is used by many major organizations, including the Smithsonian Institution, Universal Music Group, Pfizer, Johnson & Johnson, Princeton University, and Columbia University, for their websites.<\/p>\n\n\n\n The first flaw affects Drupal’s form API. The flaw is due to improper input validation, which means that what is uploaded via the form API is not validated to see if it is allowed or not.<\/p>\n\n\n\n A common best practice is to validate what is uploaded or entered into a form. In general, input validation is performed using an Allow List approach, in which the form expects specific inputs and rejects anything that does not match the expected input or upload.<\/p>\n\n\n\n When a form fails to validate input, the website is vulnerable to file uploads, which can cause unexpected behavior in the web application.<\/p>\n\n\n\nDrupal<\/h2>\n\n\n\n
Incorrect Input Validation in Form API<\/h2>\n\n\n\n