CVE-2020-13671: Drupal Core RCE Vulnerability

CVE-2020-13671 Overview

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This vulnerability affects Drupal Core versions 9.0 prior to 9.0.8, 8.9 prior to 8.9.9, 8.8 prior to 8.8.11, and 7 prior to 7.74.

This unrestricted file upload vulnerability (CWE-434) allows authenticated attackers to bypass file extension validation by uploading maliciously crafted filenames. When combined with certain server configurations, these files may be executed as PHP code, potentially leading to full remote code execution on the affected Drupal installation.

Critical Impact

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Authenticated attackers can upload files that execute arbitrary PHP code, potentially leading to complete site compromise including data theft, defacement, and lateral movement within the network.

Affected Products

• Drupal Core 9.0 versions prior to 9.0.8
• Drupal Core 8.9 versions prior to 8.9.9
• Drupal Core 8.8 versions prior to 8.8.11
• Drupal Core 7 versions prior to 7.74
• Fedora 32 and Fedora 33 (bundled Drupal packages)

Discovery Timeline

• 2020-11-20 - CVE-2020-13671 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2020-13671

Vulnerability Analysis

The vulnerability stems from improper filename sanitization in Drupal's file upload handling mechanism. When users upload files, Drupal core fails to adequately validate and sanitize certain filename patterns, allowing attackers to craft filenames that bypass extension restrictions.

The core issue lies in how the system processes double extensions or specially crafted filename sequences. For example, a file named malicious.php.txt might be uploaded successfully, but depending on the web server configuration (particularly Apache with certain .htaccess rules or misconfigurations), the file could be interpreted and executed as PHP rather than served as a plain text file.

This vulnerability requires the attacker to have authenticated access with file upload permissions. However, given that many Drupal sites allow user registration with upload capabilities for profile images or content attachments, the attack surface is significant.

Root Cause

The root cause of CVE-2020-13671 is insufficient input validation in Drupal's file upload sanitization routines. The system does not properly handle edge cases in filename parsing, particularly around:

1. Double file extensions (e.g., .php.txt, .phtml.jpg)
2. Null bytes or special characters in filenames
3. Case sensitivity mismatches between Drupal's validation and the underlying web server

When combined with permissive web server configurations that execute PHP files based on filename patterns rather than strict extension matching, this creates a direct path to remote code execution.

Attack Vector

The attack requires network access and low-privilege authentication. An attacker with file upload permissions (such as a registered user on a Drupal site with content creation or profile editing capabilities) can exploit this vulnerability through the following mechanism:

1. The attacker prepares a PHP webshell or malicious script with a crafted filename designed to bypass Drupal's extension validation
2. The file is uploaded through a legitimate Drupal upload interface (content creation, profile image, file field)
3. Drupal accepts the upload due to insufficient filename sanitization
4. When accessed via the web server, the file is interpreted as PHP and executed
5. The attacker gains arbitrary code execution with the privileges of the web server process

This vulnerability is particularly dangerous on shared hosting environments or servers with legacy Apache configurations that process PHP based on filename patterns.

Detection Methods for CVE-2020-13671

Indicators of Compromise

• Presence of files with suspicious double extensions in Drupal's sites/default/files/ directory (e.g., .php.txt, .phtml.jpg, .php.png)
• Unexpected PHP files in upload directories that should only contain images or documents
• Web server access logs showing requests to unusual file paths within Drupal's public files directory
• Newly created files in upload directories with recent timestamps that don't correspond to legitimate user activity

Detection Strategies

• Audit all files in Drupal's public and private file directories for double extensions or embedded PHP code
• Review web server access logs for requests to files in upload directories with unexpected extensions
• Implement file integrity monitoring on Drupal installation directories to detect unauthorized file additions
• Deploy web application firewall (WAF) rules to detect and block requests containing PHP execution signatures in upload paths

Monitoring Recommendations

• Enable detailed logging for all file upload operations in Drupal and correlate with user authentication events
• Configure SentinelOne to monitor file creation events in web-accessible directories, alerting on files with executable extensions
• Establish baseline patterns for legitimate file uploads and alert on anomalies such as unusual file sizes, extension combinations, or upload frequency
• Monitor web server processes for unexpected child process spawning that may indicate successful exploitation

How to Mitigate CVE-2020-13671

Immediate Actions Required

• Upgrade Drupal Core immediately to patched versions: 9.0.8+, 8.9.9+, 8.8.11+, or 7.74+
• Audit existing uploaded files for malicious content, particularly files with double extensions or unexpected PHP code
• Review and restrict file upload permissions to only trusted user roles
• Implement strict web server configurations that prevent PHP execution in upload directories

Patch Information

The Drupal Security Team has released patched versions addressing this vulnerability. Organizations should upgrade to the following versions or later:

• Drupal 9.0.x: Upgrade to version 9.0.8 or later
• Drupal 8.9.x: Upgrade to version 8.9.9 or later
• Drupal 8.8.x: Upgrade to version 8.8.11 or later
• Drupal 7.x: Upgrade to version 7.74 or later

For detailed patch information and upgrade instructions, refer to the Drupal Security Advisory SA-CORE-2020-012. Fedora users should apply updates through their package manager as documented in the Fedora Package Announcements.

Workarounds

• Configure web server to explicitly deny PHP execution in Drupal's files directories using .htaccess (Apache) or location blocks (Nginx)
• Implement server-side file type validation that inspects actual file content (magic bytes) rather than relying solely on filename extensions
• Deploy a web application firewall with rules to block file uploads containing PHP code patterns
• Temporarily disable file upload functionality for untrusted user roles until patches can be applied

# Apache configuration to prevent PHP execution in upload directories
# Add to .htaccess in sites/default/files/
<FilesMatch "\.php$">
    SetHandler none
    ForceType text/plain
</FilesMatch>
<FilesMatch "\.phps$">
    SetHandler none
    ForceType text/plain
</FilesMatch>

# For Nginx, add to server block
location ~* /sites/default/files/.*\.php$ {
    deny all;
}