Hands-On Web Penetration Testing with Metasploit

Understanding the Drupalgeddon vulnerability

The Drupalgeddon vulnerability is to do with a particular registration form. This form is available in all Drupal installations and can be accessed without any authentication. In this form, the email field allows unsanitized input from the user, which allows attackers to inject an array into the form array structure (as the value of the email field). The following properties can be used to exploit this vulnerability:

• #post_render
• #lazy_builder
• #pre_render
• #access_callback

Metasploit's exploit module uses the #post_render property to inject the payload into the mail array, which looks something like the following:

[ mail[#post_render][]': 'exec', // Function to be used for RCE mail[#type]': 'markup', ...