• Overview
    Frameworks
    • Drupal
    • WordPress
    • Symfony
    • Magento
    • See all frameworks
    Features
    • Observability
    • Auto-scaling
    Solutions
    • Marketing Teams
    • Retail
    • Higher Education
  • Pricing
  • Featured articles
    • Switching to Platform.sh can help IT/DevOps organizations drive 219% ROI
    • Organizations, the ultimate way to manage your users and projects
  • Support
  • Docs
  • Contact
  • Login
  • Free Trial
Blog

Platform.sh and Drupal 7.32 Core SQL Injection

drupal
October 15, 2014
Shannon Vettes
Shannon Vettes

On October 15, 2014, the Drupal Security Team released Drupal 7.32 to remedy a severe SQL injection vulnerability in core. Platform.sh took immediate actions to protect all Drupal customers. Here is the list of specific actions that have been taken, and some answers to questions that our customers have asked us.

Steps taken by Commerce Guys:

All customers have been contacted directly with instructions for eliminating the vulnerability.

Platform.sh is able to recognize whether a Drupal site is vulnerable to this attack. Whenever the vulnerability is detected, this is what happens:

On Platform.sh Standard production sites, POST requests are blocked, and GET requests are sanitized (query strings, cookies, and custom headers are stripped). This allows your site to remain online, although it will not be functional as a CMS.

On Platform.sh Standard development sites, access is denied outright and a message is shown with instructions to fix the problem.

Platform.sh Enterprise customers, as well as customers with application support packages, will have their sites updated directly by the Platform.sh team. They will be contacted to confirm this patch is being managed for them, so if you didn’t get contacted you need to perform this update yourselves.

As soon as your Drupal site has been upgraded to 7.32, or patched manually, the security measures above will be deactivated and your site will operate normally. Note that every environment needs to be updated (via Git push, Synchronize, or Merge).

How will the site be blocked?

If you are trying to access a Drupal site hosted on Platform.sh and see this message, Platform.sh has blocked your request.

We apologize, but this page is not currently accessible. The site administrator has been informed and we hope to have the issue resolved soon.

Once the Drupal site has been updated, this message will disappear and the site will return to normal.

How do I apply the security upgrade?

You need to upgrade your website to Drupal 7.32, or apply this patch for any Drupal 7 version.

On Platform.sh, it depends on the way you deployed your website:

  • If you are deploying your website with the Drush Make workflow, simply edit your  project.make  file and replace the Drupal core version with  projects[drupal][version] = 7.32 .
  • If you are using a distribution of Drupal (Drupal Commons, Commerce Kickstart, etc.) that is not yet updated, add:  projects[yourcoreprojectname][patch][] = "<link to the patch>"  to the project.
  • If you are deploying your website manually (“vanilla mode”), apply this patch manually.

Remember, for customers who subscribe to Platform.sh Enterprise, Developer Support, and Application Support packages, the patch will be made for you.

If you are a Platform.sh Standard customer, you need to apply the patch yourself, otherwise a protective block will be placed on only the sensitive pages until the patch is applied.

This is terrible, I can’t afford to have downtime!

You’re right. However, this particular security announcement from the Drupal Security Team is particularly nasty as it reveals a security hole that is both easy to exploit and can be used to completely infiltrate your site. Being hacked is worse than downtime, which is why the Platform.sh team has taken steps to help guarantee that no security breach takes place.

Get the latest Platform.sh news and resources
Subscribe

Related Content

Cover image

A series of unfortunate commits: notable software security stories

Company

AboutSecurity and complianceTrust CenterBoard and investorsCareersPressContact us
System StatusPrivacyTerms of ServiceImpressumWCAG ComplianceManage your cookie preferencesReport a security issue
© 2022 Platform.sh. All rights reserved.
Supported by Horizon 2020's SME Instrument - European Commission 🇪🇺