drupal_module-search_api_attachments-arbitrary-php-code-execution.yaml

id: drupal_module-search_api_attachments-arbitrary-php-code-execution
info:
  name: drupal_module-search_api_attachments-arbitrary-php-code-execution
  author: Bishopfox
  severity: medium
  description: "This module enables you to extract the textual content of files for use on a website, e.g. to display it or use it in search indexes. The module doesnt sufficiently protect the administrator-defined commands that are executed on the server, which leads to post-authentication remote code execution by a limited set of users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission administer search_api. Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission."
  reference:
    - https://www.drupal.org/sa-contrib-2021-034
  metadata:
    security-risk: "Critical 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default"
    vulnerability: "arbitrary-php-code-execution"
    fofa-query: "/sites/all/modules/search_api_attachments/"
    google-query: "inurl:'/sites/all/modules/search_api_attachments/"
    impact: medium
    type: indicator
    created_at: '0001-01-01T00:00:00Z'
  tags: drupal

http:
  - method: GET
    redirects: true
    max-redirects: 3
    path:
      - "{{BaseURL}}/sites/all/modules/search_api_attachments/search_api_attachments.info"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'version = "([0-9]+\.x-[0-9]+\.[0-9]+)"'
      - type: status
        status:
          - 200
      - type: word
        words:
          - 'search_api_attachments'
        part: body

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'version = "([0-9]+\.x-[0-9]+\.[0-9]+)"'

      - type: dsl
        dsl:
         - compare_versions(version, '7.x-1.18')
         - compare_versions(version, '7.x-1.17')
         - compare_versions(version, '7.x-1.16')
         - compare_versions(version, '7.x-1.15')
         - compare_versions(version, '7.x-1.14')
         - compare_versions(version, '7.x-1.13')
         - compare_versions(version, '7.x-1.12')
         - compare_versions(version, '7.x-1.11')
         - compare_versions(version, '7.x-1.10')
         - compare_versions(version, '7.x-1.9')
         - compare_versions(version, '7.x-1.8')
         - compare_versions(version, '7.x-1.7')
         - compare_versions(version, '7.x-1.6')
         - compare_versions(version, '7.x-1.5')
         - compare_versions(version, '7.x-1.4')
         - compare_versions(version, '7.x-1.3')
         - compare_versions(version, '7.x-1.2')
         - compare_versions(version, '7.x-1.1')
         - compare_versions(version, '7.x-1.0')