CVE-2017-6381: High severity Drupal Drupal vulnerability
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.2.7 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.2.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.2 - Remove
Remove
drupal 8 production deployments/<siteroot>/vendor/phpunitfrom your environment.Remove the <siteroot>/vendor/phpunit directory from production deployments to ensure you aren't vulnerable.
- Configuration
Ensure the default .htaccess protection against PHP execution is in place for production deployments to mitigate the remote code execution risk.
Drupal PHP execution in production via .htaccess protection = ensure default .htaccess protection is present (prevents PHP execution)
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6381?
CVE-2017-6381 has a critical severity rating due to its potential for remote code execution.
How do I fix CVE-2017-6381?
To fix CVE-2017-6381, upgrade to Drupal core version 8.2.7 or later.
What versions of Drupal are affected by CVE-2017-6381?
CVE-2017-6381 affects Drupal versions 8.0.x and 8.1.x up to 8.1.10, as well as versions from 8.2.0 up to 8.2.6.
What impacts does CVE-2017-6381 pose to my Drupal site?
If exploited, CVE-2017-6381 allows attackers to execute arbitrary PHP code on the server, potentially compromising the entire site.
Is CVE-2017-6381 mitigated by default settings?
Yes, CVE-2017-6381 is partially mitigated by default .htaccess restrictions that protect against PHP execution.