Stopping Drupal’s SA-CORE-2019-003 Vulnerability
Mar 5, 2019Richard Sommerville
Summary
This post details Cloudflare's rapid response to the Drupal SA-CORE-2019-003 vulnerability. Upon announcement, Cloudflare analyzed the patch, identified the deserialization exploit vector, and developed WAF rules (specifically D0020) to mitigate it. The post showcases the speed of this process, from vulnerability disclosure to rule deployment and attack blocking, highlighting the effectiveness of Cloudflare's WAF in protecting customers against zero-day exploits. It also provides examples of malicious payloads observed, including those leveraging the 'guzzle/rce1' gadget and attempts to download backdoors.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack