Expandable ads are hacker's new backdoor into commercial websites Watch Now

The Drupal project is urging website admins to install updates immediately after disclosing a highly critical remote code execution bug affecting the Drupal core CMS.

The bug was considered serious enough for Drupal's security team to warn admins a day in advance of Wednesday's patch release to reserve time to address the bug.

Drupal is the third most popular CMS for website publishing, accounting for about three percent of the world's billion-plus websites. Hackers could use the flaw, tracked as CVE-2019-6340, to hijack a Drupal site and potentially take control of a web server.

According to Drupal, the bug is due to some file types not properly sanitizing data from non-form sources, such as RESTful web services. This failing can lead to arbitrary PHP code execution, it warns.

Until an update to a secure version can be completed, admins can mitigate the bug by disabling all web services modules, according to Drupal's advisory. Admins could also mitigate the bug by disallowing PUT/PATCH/POST requests to web services resources.

Affected branches of Drupal core include Drupal 8.6.x and Drupal 8.5.x and earlier. Admins should immediately upgrade to each branch's fixed versions, which are Drupal 8.6.10 and Drupal 8.5.11.

Sites are only affected if the Drupal 8 core RESTful Web Services (rest) module is enabled and allows PATCH or POST requests. Also affected are sites with other web services modules enabled, such as JSON:API in Drupal 8, as well as the Service module or the RESTful Web Services module in Drupal 7.

SEE: How to build a successful developer career (free PDF)

Drupal warns that after updating Drupal core, admins will need to install security updates for several affected third-party Drupal projects. These include Font Awesome Icons, Translation Management Tool, Paragraphs, Video, Metatag, Link, JSON:API, and RESTful Web Services.

Drupal 7 core doesn't actually need to be updated, but Drupal warns that some of the aforementioned third-party projects for Drupal 7 will need to be updated.

The bug was discovered by the Drupal security team, so it's likely the bug has not yet been exploited in the wild. But given the severity of the bug and the pre-release alert, it would appear the project expects the bug could be exploited in the near future.

Over recent months, hackers have been making use of Drupal sites that didn't install updates to address several 'Drupalgeddon 2' flaws that were disclosed last spring. The attacks mainly aimed to install cryptocurrency miners on affected web servers.

The attackers had plenty of Drupal sites to work with. Research found over 100,000 sites were still running a versions of the CMS vulnerable to Drupalgeddon 2 bugs three months after fixed versions had been released.

Previous and related coverage