Description
The DRD Agent module exposes callback endpoints so the central Drupal Remote Dashboard can run actions against a remote site, loading its helper library (drd_agent_lib) on demand as a phar archive.
The module doesn't authenticate or validate library loading before performing it: its library-loading helper builds a phar archive filename by concatenating the attacker-controlled X-DRD-VERSION request header into the name, fetches that archive from a base URI over HTTPS, writes the response to a file under the temporary stream wrapper, then includes (require_once, with a require fallback) that attacker-header-derived path, with no validation of the header value, no checksum or signature verification of the archive, and no authentication. The drd-agent, drd-agent-crypt, and drd-agent-authorize-secret menu items are all registered as publicly accessible, and each calls the library-loading helper as its first statement, before any signature or secret check. An unauthenticated attacker can therefore influence both the fetched URL and the local include path (via traversal or scheme injection, or a poisoned temporary phar file).
The archive is fetched over HTTPS from a trusted host (`git.drupalcode.org`), and a non-`200` response throws, so the attacker cannot serve arbitrary code through the fetch path alone; there is no cleartext channel to MITM. Consequently this is not a self-contained remote code execution: the dangerous primitive (an unauthenticated, header-derived `require` with no integrity check) reaches arbitrary code execution only when chained with a separate precondition that places attacker-controlled `.phar` content on disk at the resolved path (e.g. another file-write/upload vulnerability poisoning the `temporary://` file, or compromise of the trusted host). It nonetheless belongs to the remote-file-inclusion / phar code-execution class of unsafe dynamic inclusion, in the same family as the core deserialization fix SA-CORE-2019-003 / CVE-2019-6340, and the unauthenticated, unvalidated, integrity-unchecked inclusion is a defect worth fixing on its own merits.
Solution
Install the latest version.
If you use the DRD Agent module for Drupal 7, upgrade to DRD Agent 7.x-3.7:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES