CVE-2022-25277 Drupal core arbitrary PHP code execution
Attackers can upload malicious .htaccess files to bypass protections and achieve remote code execution if file fields are explicitly configured to allow this extension.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25277?
CVE-2022-25277 is a high-severity vulnerability in Drupal Drupal, published on 26 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.
Weakness: CWE-434
Which versions are affected by CVE-2022-25277?
6 open source packages ship an affected version, including drupal/core and drupal. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 8.0.0 | 9.3.19, 9.4.3 |
drupal/core Packagist | From 8.0.0 | 9.3.19 |
drupal/core Packagist | From 8.0.0 | 9.3.19 |
drupal/core Packagist | From 9.4.0 | 9.4.3 |
drupal/core Packagist | From 9.4.0 | 9.4.3 |
drupal Bitnami | From 8.0.0 | 9.3.19, 9.4.3 |
Products include Drupal Drupal.
How do I fix CVE-2022-25277?
Upgrade drupal/core to a fixed version for your release line: 9.3.19 or 9.4.3.
Is CVE-2022-25277 being exploited?
There is no known exploitation of CVE-2022-25277 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2022-25277, DRUPAL-CORE-2022-014, GHSA-6955-67hm-vjjq, UBUNTU-CVE-2022-25277.