PHAR stream wrapper Arbitrary PHP code execution
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.62, 8.6.6., 8.5.9, 8.6.6, 7.62.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.
Timeline
- CVE published
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Drupal Drupal core
From 7.x · fixed in 7.62; From 8.6.x · fixed in 8.6.6.; From 8.5.x · fixed in 8.5.9
- drupal/corePackagist
From 8.0.0 · fixed in 8.5.9; From 8.6.0 · fixed in 8.6.6
- drupal/drupalPackagist
From 7.0.0 · fixed in 7.62.0
- drupal/drupalPackagist
From 8.0.0 · fixed in 8.5.9
- drupal/drupalPackagist
From 8.6.0 · fixed in 8.6.6
- drupal/corePackagist
From 7.0.0 · fixed in 7.62.0
- drupal/corePackagist
From 8.0.0 · fixed in 8.5.9
- drupal/corePackagist
From 8.6.0 · fixed in 8.6.6