CVE-2022-25277
📋 TL;DR
This vulnerability allows attackers to bypass Drupal's filename sanitization when .htaccess files are explicitly allowed for upload, potentially leading to remote code execution on Apache servers. It affects Drupal sites where administrators have configured file fields to permit .htaccess extensions. The risk is limited because it requires specific administrative configuration.
💻 Affected Systems
- Drupal Core
📦 What is this software?
Drupal by Drupal
Drupal by Drupal
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on Apache web servers through malicious .htaccess file upload, potentially leading to full server compromise.
Likely Case
Limited impact since most sites don't allow .htaccess uploads; attackers would need administrative access to configure vulnerable file fields first.
If Mitigated
No impact if .htaccess uploads are not explicitly allowed or if the patch is applied.
🎯 Exploit Status
Exploitation requires administrative access to configure vulnerable file fields first, then uploading malicious .htaccess files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Drupal 9.3.14, 9.4.3, or 10.0.2
Vendor Advisory: https://www.drupal.org/sa-core-2022-014
Restart Required: No
Instructions:
1. Update Drupal core to version 9.3.14, 9.4.3, or 10.0.2 or higher. 2. Run update.php or use drush/drupal console: 'drush up drupal' or 'composer update drupal/core-recommended --with-dependencies'. 3. Clear all caches.
🔧 Temporary Workarounds
Disable .htaccess file uploads
allRemove .htaccess from allowed extensions in all file fields
Navigate to Content -> Structure -> Content types -> Manage fields -> Edit file field -> Remove 'htaccess' from allowed extensions
🧯 If You Can't Patch
- Review all file field configurations and ensure .htaccess is not in allowed extensions list
- Implement web application firewall rules to block .htaccess file uploads at the network level
🔍 How to Verify
Check if Vulnerable:
Check Drupal version: if running 9.3.x < 9.3.14, 9.4.x < 9.4.3, or 10.0.x < 10.0.2 AND have file fields allowing .htaccess extensions.Check Version:
drush status | grep 'Drupal version' OR check /admin/reports/status pageVerify Fix Applied:
Verify Drupal version is 9.3.14+, 9.4.3+, or 10.0.2+ using 'drush status' or check /admin/reports/status📡 Detection & Monitoring
Log Indicators:
- File upload attempts with .htaccess extension
- Apache error logs showing .htaccess parsing errors
Network Indicators:
- HTTP POST requests uploading files with .htaccess extension
SIEM Query:
source="apache_access" AND uri_path="*upload*" AND request_body="*.htaccess*"