CVE-2020-13675
📋 TL;DR
CVE-2020-13675 is a critical access bypass vulnerability in Drupal's JSON:API and REST/File modules that allows attackers to upload files without proper validation. This affects Drupal sites using these modules, potentially enabling malicious file uploads that could lead to remote code execution. All Drupal administrators should treat this as a high-priority security issue.
💻 Affected Systems
- Drupal Core
📦 What is this software?
Drupal by Drupal
Drupal by Drupal
Drupal by Drupal
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and persistent backdoor installation
Likely Case
Malicious file upload enabling web shell deployment, privilege escalation, and lateral movement within the environment
If Mitigated
File upload attempts logged and blocked, with no successful exploitation due to proper validation controls
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. Attackers can upload malicious files without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Drupal 8.8.11, 8.9.9, 9.0.9 or later
Vendor Advisory: https://www.drupal.org/sa-core-2021-008
Restart Required: No
Instructions:
1. Backup your Drupal site and database. 2. Update Drupal core to the patched version using Composer: 'composer update drupal/core --with-dependencies'. 3. Run database updates: 'drush updatedb' or via admin interface. 4. Clear all caches: 'drush cr' or via admin interface.
🔧 Temporary Workarounds
Disable vulnerable modules
allTemporarily disable JSON:API and REST/File modules until patching is possible
drush pm:uninstall jsonapi
drush pm:uninstall rest
Implement file upload restrictions
linuxConfigure web server to block file uploads to vulnerable endpoints
# Apache: Add to .htaccess
<LocationMatch "\/jsonapi\/file\/upload">
Deny from all
</LocationMatch>
# Nginx: Add to server block
location ~* \/jsonapi\/file\/upload {
deny all;
}
🧯 If You Can't Patch
- Disable JSON:API and REST/File modules immediately
- Implement strict WAF rules to block file uploads to /jsonapi/file/upload endpoints
🔍 How to Verify
Check if Vulnerable:
Check Drupal version: 'drush status' or navigate to /admin/reports/status. If version is 8.8.x < 8.8.11, 8.9.x < 8.9.9, or 9.0.x < 9.0.9, you are vulnerable.Check Version:
drush status | grep 'Drupal version' or check /admin/reports/status in browserVerify Fix Applied:
Confirm Drupal version is 8.8.11+, 8.9.9+, or 9.0.9+ and test file upload functionality through JSON:API endpoints📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /jsonapi/file/upload endpoints
- Multiple failed file upload attempts with unusual extensions
- POST requests to JSON:API with file upload parameters
Network Indicators:
- HTTP POST requests to /jsonapi/file/upload with file content
- Unusual traffic patterns to Drupal file upload endpoints
SIEM Query:
source="drupal_access.log" AND (uri_path="/jsonapi/file/upload" OR uri_path="/file/upload/rest") AND http_method="POST"