Drupalgeddon2 templated

[robert-doyensec]

Testbed changes are at doyensec/security-testbeds#46

{
  "scanStatus": "SUCCEEDED",
  "scanFindings": [{
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkService": {
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    },
    "vulnerability": {
      "mainId": {
        "publisher": "GOOGLE",
        "value": "CVE_2018_7600"
      },
      "relatedId": [{
        "publisher": "CVE",
        "value": "CVE-2018-7600"
      }],
      "severity": "CRITICAL",
      "title": "Drupalgeddon 2 (CVE-2018-7600)",
      "description": "This version of Drupal is vulnerable to CVE-2018-7600. Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 are vulnerable to this vulnerability. Drupal has insufficient input sanitation on Form API AJAX requests. This enables an attacker to inject a malicious payload into the internal form structure which would then be executed without any authentication",
      "recommendation": "Upgrade to at least Drupal 8.3.9 or Drupal 8.5.1."
    }
  }],
  "scanStartTimestamp": "2026-07-02T14:02:41.217Z",
  "scanDuration": "4.695s",
  "fullDetectionReports": {
    "detectionReports": [{
      "targetInfo": {
        "networkEndpoints": [{
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        }]
      },
      "networkService": {
        "networkEndpoint": {
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        },
        "transportProtocol": "TCP",
        "serviceName": "http",
        "serviceContext": {
          "webServiceContext": {
          }
        }
      },
      "detectionTimestamp": "2026-07-02T14:02:42.855Z",
      "detectionStatus": "VULNERABILITY_VERIFIED",
      "vulnerability": {
        "mainId": {
          "publisher": "GOOGLE",
          "value": "CVE_2018_7600"
        },
        "relatedId": [{
          "publisher": "CVE",
          "value": "CVE-2018-7600"
        }],
        "severity": "CRITICAL",
        "title": "Drupalgeddon 2 (CVE-2018-7600)",
        "description": "This version of Drupal is vulnerable to CVE-2018-7600. Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 are vulnerable to this vulnerability. Drupal has insufficient input sanitation on Form API AJAX requests. This enables an attacker to inject a malicious payload into the internal form structure which would then be executed without any authentication",
        "recommendation": "Upgrade to at least Drupal 8.3.9 or Drupal 8.5.1."
      }
    }]
  },
  "reconnaissanceReport": {
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkServices": [{
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    }]
  },
  "targetAlive": true
}

[giacomo-doyensec]

LGTM