A persistent Drupal 7 exploit using a pluggable variable

A couple of years ago I was asked to take a look at a Drupal 7 site that was performing poorly where a colleague had spotted a strange function call in an Application Performance Management (APM) system.

The APM traces we were looking at included a __lamda_func under which was a class called Ratel. Under those were some apparent external calls to some dodgy looking domains.

One of my very excellent colleagues had done some digging and found some more details about the domains which confirmed their apparent dodginess.

Assessing the likelihood of a Drupal exploit of Ghostscript Zero Day CVE-2021-3781

Drupal 9 detects a fake image file

My colleagues and I in the Drupal Security Team recently became aware of a Zero Day RCE vulnerability in Ghostscript. This was later assigned CVE-2021-3781.

At least one viable Proof of Concept (PoC) was made public not long after the Zero Day which illustrated Scalable Vector Graphics (SVG) handling in Imagemagick being used as an attack vector.

Checking for Bad Passwords in Drupal with Drop the Ripper to Avoid Site Compromise

This was originally posted on the dev.acquia.com blog.

Easy-to-guess passwords are all too often the means by which intruders gain unauthorised access. It's useful to be able to audit the passwords in use on your site - especially for user accounts with administrative privileges.

Password Policies and Drupal

The default Drupal 7 password form
Correct Horse Battery Staple - credit xkcd.com

This was originally posted on the dev.acquia.com blog.

People tend to choose bad passwords if they are allowed to.

By default Drupal provides some guidance about how to "make your password stronger," but there's no enforcement of any particular password policy out of the box. As usual, there's a module for that. More than one in fact.

DNS entries for local development using dnsmasq

Sometimes it's handy to have local DNS entries, for example when you're working on a copy of a site on your local machine - perhaps via a VM, vagrant, lxc or docker. A simple way of doing this is to add entries to your hosts file e.g.:

# local site
127.0.0.1   dev.mcdruid.co.uk

It can be a bit of pain though having to set one - or sometimes more - of these up for every new site you work on.

How to reset the password for an lxc container

If you find yourself stuck trying to login to an lxc container because you've forgotten the password, here's a simple fix.

With the container stopped, on the host machine (assuming it's ubuntu - other linux flavours may vary slightly), navigate as root to:

/var/lib/lxc/$container_name/rootfs/etc

Then edit the shadow file (perhaps make a backup first), and remove the hash which corresponds to the user's password, leaving the separating colons in place e.g.:

ubuntu::16372:0:99999:7:::
Tags: 

How to cleanly delete a Drupal file with drush

This is a simple trick which (unless my googlefu simply failed me) I didn't find described anywhere when I had a quick look:

$ drush ev '$file = file_load(21749); var_dump(file_delete($file, TRUE));'
bool(true)

Bulk export GPS data from Ultrasport NavRun 500 watch

I have an Ultrasport NavRun 500 which is quite a decent GPS watch for running, but has a couple of software limitations - especially from the point of view of a linux (or mac) user. It uses a proprietary tkl file format which doesn't seem to be natively supported by GPSBabel.

Check your cache before you wreck yourself

Cache invalidation is known as one of the very few hard things in computer science.

It seems to be a common misconception that Drupal's cache_get checks whether a given cache entry has expired, and won't return a stale result. In fact, in Drupal this is not always the case.

git commit author - give credit where credit is due

Quite some time ago I wrote a post about how patching makes you feel good in which I talked about the motivations for, and benefits of submitting patches on drupal.org (d.o). I concluded by suggesting that project maintainers should be generous in recognising the efforts of those who submit patches.

Subscribe to mcdruid.co.uk RSS