More than 19 months after its public disclosure the CVE-2014-3704 is still exploited in attacks against Drupal-based websites.
It was October 2014, when Drupal patched a critical SQL injection vulnerability (CVE-2014-3704) that was affecting all Drupal core 7.x versions up to the recently-released 7.32 version, which fixed the issue. The patch issued by Drupal fixed the critical SQL injection vulnerability flaw that could be exploited by threat actors to do a dump of the database used by the targeted site, without needing an account or tricking a user into exposing credentials.
Due to its impact, the CVE-2014-3704 flaw was dubbed by the experts “Drupalgeddon.” You are thinking why I’m telling about an old flaw, 19 months later, and the answer is simple.
Even today, there are many websites that are still affected by the vulnerability, also a portal of the Mossack Fonseca was plagued by this security flaw.
The experts from Sucuri firm have been monitoring attacks on Drupal based websites leveraging on the CVE-2014-3704 flaw. According to Sucuri observed, thousands of websites were compromised in the months after the disclosure of the flaw (October and November 2014), but the most worrisome news is that the cyber attacks remained consistent throughout 2015 and 2016.
“After the initial attacks in October and November of 2014, the attacks dropped and remained consistent through 2016. If someone had not patched, they are surely compromised now.” states Sucuri in a blog post.
In the vast majority of attacks observed by Sucuri, hackers have exploited the CVE-2014-3704 vulnerability to create new admin accounts on Drupal websites, below attacks trying to force a new admin with names Derevos, Holako and Mr.R00t2_404,respectively.
“Most attacks leverage the SQL injection vulnerability to create a new admin user with injections like the following:”
name[0%20;update+users+set+name%3d%27derevos%27,+pass%3d%27$S$CTo9G7Lx2mQZv/dfetGZcq7 e1cVNpFpTRdZ8EckF/d6BnrMPZ/Ce%27+where+uid%3d%271%27;;#%20%20]=bob&name[0]=test&pass=shit2&test2=test
Example 2:
name[0;update users set name %3D 'HolaKo' , pass %3D '%24S%24DrV4X74wt6bT3BhJa4X0.XO5bHXl%2FQBnFkdDkYSHj3cE1Z5clGwu' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test
Example 3:
POSTLOG:name[0;update users set name %3D 'Mr.R00t2_404' , pass %3D '%24S%24DrV4X74wt6bT3BhJa4X0.XO5bHXl%2FQBnFkdDkYSHj3cE1Z5clGwu',status %3D'1' where uid %3D '1';#]=test3&name[]=Crap&pass=test&test2=test
The experts from Sucuri are warning of a significant increase in SEO spam attacks against Drupal 7 websites.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Drupal, CVE-2014-3704)
[adrotate banner=”5″]
[adrotate banner=”13″]
