Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw

Drupal development team yesterday released^[1]
important security updates for its widely used open-source content
management software that addresses a critical and three “moderately
critical” vulnerabilities in its core system.

Considering that Drupal-powered websites are among the all-time
favorite targets for hackers, the website administrators are highly
recommended to install the latest release Drupal 7.69, 8.7.11, or
8.8.1 to prevent remote hackers from compromising web servers.

Critical Symlinks Vulnerability in Drupal

The only advisory with critical severity includes patches for
multiple vulnerabilities in a third-party library, called ‘Archive_Tar^[2],’ that Drupal Core uses
for creating, listing, extracting, and adding files to tar
archives.
The vulnerability resides in the way the affected library untar
archives with
symlinks^[3], which, if exploited,
could allow an attacker to overwrite sensitive files on a targeted
server by uploading a maliciously crafted tar file.

Due to this, to be noted, the flaw only affects Drupal websites
that are configured to process .tar, .tar.gz, .bz2, or .tlz files
uploaded by untrusted users.

According to Drupal developers, a proof-of-concept exploit for
this vulnerability already exists and considering the popularity of
Drupal exploits among hackers, you may see hackers actively
exploiting this flaw in the wild to target Drupal websites.

Moderately Critical Drupal Vulnerabilities

Besides this critical vulnerability, Drupal developers have also
patched three “moderately critical” vulnerabilities in its Core
software, brief details of which are as follows:

• Denial of Service (DoS): The install.php file used by
  Drupal 8 Core contains a flaw that can be exploited by a remote,
  unauthenticated attacker to impair the availability of a targeted
  website by corrupting its cached data.
• Security Restriction Bypass: The file upload function in
  Drupal 8 does not strip leading and trailing dot (‘.’) from
  filenames, which can be used by an attacker with file upload
  ability to overwrite arbitrary system files, such as .htaccess to
  bypass security protections.
• Unauthorized Access: This vulnerability exists in
  Drupal’s default Media Library module when it doesn’t correctly
  restrict access to media items in certain configurations. Thus, it
  could allow a low-privileged user to gain unauthorized access to
  sensitive information that is otherwise out of his reach.

According to the developers, affected website administrators can
mitigate the access media bypass vulnerability by unchecking the
“Enable advanced UI” checkbox on /admin/config/media/media-library,
though this mitigation is not available in 8.7.x.

Since a proof-of-concept exists for the critical Drupal
vulnerability, users running vulnerable versions of Drupal are
highly recommended to update their CMS to the latest Drupal core
release as soon as possible.