CVE-2024-13267
📋 TL;DR
This vulnerability allows attackers to include and execute arbitrary PHP files on Drupal sites using the Opigno TinCan Question Type module. It affects Drupal 7 installations with the vulnerable module versions, potentially leading to remote code execution. Site administrators using affected versions should patch immediately.
💻 Affected Systems
- Drupal Opigno TinCan Question Type
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local file inclusion allowing attackers to read sensitive files, escalate privileges, or execute limited PHP code.
If Mitigated
Limited impact if proper file permissions and web server restrictions prevent PHP execution from unauthorized directories.
🎯 Exploit Status
Exploitation likely requires some level of access or social engineering to trigger the vulnerable functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.X-1.3
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-031
Restart Required: No
Instructions:
1. Download version 7.X-1.3 from Drupal.org. 2. Replace the existing Opigno TinCan Question Type module files. 3. Clear Drupal caches via admin/config/development/performance. 4. Verify the module version shows 7.X-1.3.
🔧 Temporary Workarounds
Disable vulnerable module
allTemporarily disable the Opigno TinCan Question Type module until patching is possible.
drush dis opigno_tincan_question_type
Or disable via Drupal admin interface at admin/modules
🧯 If You Can't Patch
- Implement strict file permissions to prevent PHP execution from user-uploaded directories.
- Use web application firewall rules to block suspicious file inclusion patterns.
🔍 How to Verify
Check if Vulnerable:
Check the module version at admin/modules or via drush: drush pml | grep opigno_tincan_question_typeCheck Version:
drush pml --status=enabled --type=module | grep opigno_tincan_question_typeVerify Fix Applied:
Confirm module version is 7.X-1.3 or higher via admin/modules or drush command.📡 Detection & Monitoring
Log Indicators:
- Unusual file inclusion attempts in web server logs
- PHP errors related to file inclusion failures
- Access to unexpected PHP files via web requests
Network Indicators:
- HTTP requests with suspicious file paths containing '../' or similar directory traversal patterns
SIEM Query:
web_access_logs WHERE url CONTAINS 'opigno_tincan_question_type' AND (url CONTAINS '../' OR url CONTAINS 'php://' OR url CONTAINS 'file://')