Saint Drupalgeddon 2, Scourge of Websites

Patron of Drupal websites, forms that trust their input, and administrators across half the internet.

Life

On 28 March 2018 Drupal published the advisory for CVE-2018-7600, at once nicknamed Drupalgeddon 2. A flaw in how form parameters were handled let anyone, without authenticating, run code on the site. Scored 9.8, with countless exposed sites and, within days, scanners and botnets at work. It ended up in CISA's catalogue of exploited vulnerabilities.

Prayer

O Saint Drupalgeddon 2, who enters through the contact form, keep our forms from taking orders from visitors. Amen.

How to celebrate

Celebrated by updating Drupal to 7.58, 8.5.1 or later on the very day of the advisory, without delay.

A form that trusts is a site that falls.