CVE-2022-25277: Drupal Core RCE Vulnerability

CVE-2022-25277 Overview

CVE-2022-25277 is an unrestricted file upload vulnerability affecting Drupal core that can lead to remote code execution on Apache web servers. The vulnerability stems from an interaction between two separate security mechanisms—filename sanitization for dangerous extensions and stripping of leading/trailing dots—that do not function correctly when used together. When both protections are active, files with .htaccess extensions may not be properly sanitized, potentially allowing attackers to bypass Drupal's default .htaccess security protections.

Critical Impact

Successful exploitation can result in remote code execution on Apache web servers by uploading malicious .htaccess files that bypass Drupal's default security configurations.

Affected Products

• Drupal core (multiple versions)
• Drupal CMS deployments on Apache web servers
• Sites with file fields configured to allow .htaccess extensions

Discovery Timeline

• 2023-04-26 - CVE-2022-25277 published to NVD
• 2025-02-03 - Last updated in NVD database

Technical Details for CVE-2022-25277

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw exists in how Drupal core handles filename sanitization when multiple security measures interact. Drupal implements two distinct protections: one sanitizes filenames with dangerous extensions (implemented in SA-CORE-2020-012) and another strips leading and trailing dots to prevent server configuration file uploads (implemented in SA-CORE-2019-010).

When both protections are applied to a file upload, the interaction between these mechanisms creates a gap that allows .htaccess files to bypass sanitization. This can enable attackers to upload malicious Apache configuration files that override the security settings provided by Drupal's default .htaccess files.

Root Cause

The root cause lies in the order of operations and interaction between two separate security patches. The filename sanitization logic does not properly account for edge cases where both dangerous extension sanitization and dot-stripping occur on the same file. This creates a race condition of sorts in the sanitization pipeline, where the combination of transformations results in an improperly sanitized filename that retains the .htaccess extension.

Attack Vector

The attack vector is network-based and requires high privileges. An attacker must either:

1. Have field administrator privileges to explicitly configure a file field to allow .htaccess as a permitted extension, or
2. Exploit a contributed module or custom code that overrides the allowed file upload restrictions

Once this precondition is met, the attacker can upload a specially crafted file that exploits the sanitization bypass. The malicious .htaccess file can then modify Apache's handling of requests to the target directory, potentially enabling arbitrary PHP code execution through various Apache directives such as AddHandler or php_value.

The attack typically involves uploading an .htaccess file that enables PHP execution in normally restricted directories, followed by uploading a PHP webshell disguised with a permitted file extension.

Detection Methods for CVE-2022-25277

Indicators of Compromise

• Unexpected .htaccess files appearing in Drupal's public file directories
• File upload logs showing attempts to upload files with .htaccess extensions
• Apache error logs indicating modified handler configurations
• New or modified files in upload directories with unusual content

Detection Strategies

• Monitor file upload events for any attempts to upload files containing htaccess in the filename
• Implement file integrity monitoring on Drupal's default .htaccess files and upload directories
• Review Drupal field configurations for any file fields permitting .htaccess extensions
• Analyze web server access logs for suspicious requests to newly uploaded files

Monitoring Recommendations

• Enable and centralize Drupal's watchdog logging for file upload operations
• Configure web application firewall rules to block uploads containing Apache configuration directives
• Implement real-time alerting for any modifications to .htaccess files within the Drupal webroot
• Regularly audit file field configurations and contributed modules that modify upload permissions

How to Mitigate CVE-2022-25277

Immediate Actions Required

• Update Drupal core to the latest patched version as specified in SA-CORE-2022-014
• Audit all file field configurations to ensure .htaccess is not listed as an allowed extension
• Review contributed modules and custom code for any overrides to file upload restrictions
• Verify integrity of existing .htaccess files in Drupal directories

Patch Information

Drupal has released security updates addressing this vulnerability. Administrators should consult the official Drupal Security Advisory SA-CORE-2022-014 for specific version information and download links. Apply the appropriate patch based on your Drupal core version to resolve the sanitization bypass.

Workarounds

• Remove .htaccess from all allowed file extension lists in Drupal field configurations
• Implement Apache configuration to deny access to any .htaccess files in upload directories
• Use web server-level restrictions to prevent execution of uploaded files regardless of extension
• Consider moving to a non-Apache web server (e.g., Nginx) which does not process .htaccess files

# Apache configuration to block .htaccess in upload directories
<Directory /var/www/drupal/sites/default/files>
    <FilesMatch "\.htaccess$">
        Require all denied
    </FilesMatch>
    # Disable PHP execution in upload directory
    php_admin_flag engine off
</Directory>