Slashdot Mirror
Drupal Update Process Flawed By Multiple Bugs (softpedia.com)
An anonymous reader writes: The Drupal CMS, a favorite with large enterprises, has a few bugs in its update process, affecting both the Drupal core update and its modules. The biggest flaw of the three discovered by IOActive researchers allows an attacker to take over the sites via poisoned updates. What's worse is that Drupal's team had known of this issue since 2012, but only recently reopened discussions on fixing the problem.
Pretty much this. No serious work should EVER be done in either Drupal or Wordpress if you value security in any minor fashion.
Drupal is broken you say? And the developers let boneheaded bugs fester in the codebase for years before deciding to (maybe) think about fixing them?
Interesting. Remind me, what is Drupal again?
Of course. Why doesn't that surprise me?
But only once I discovered that "Steph the Geek" was into Drupal. Before that I was ambivalent, but she's so lame it skewed my opinion.
Must be why the Whitehouse, Weather.com, CARD.com, the New York Stock Exchange, NFL, MLS, and NBA use Drupal. they all certainly don't care for security. *rolls eyes*
Found the Joomla consultant.
Agreed. We had a design company build us a new website, and I was excited because it would be easy to modify for non-programmers and the marketing folks would be off us devs' asses. But Drupal has turned out to be a giant fucking mess I wouldn't wish on anyone. I spoke to someone in the Drupal community and their response was "well, if you are going to run Drupal, you should probably pay someone to run it for you." Fuck that. I wanted an Open Source CMS so that I could run it cheaply. What I got a was a headache worse than the old hand-coded site we had before, AND I get to pay more for a bigger server to run both PHP and an RDBMS on it.
Drupal has been a colossal mistake. I advise others to avoid it.
Just before Xmas we had the Joomla patch every version from 1->3 to fix the user agent string attack vulnerability.
Every Joomla sight I know of cough up it's configuration.php contents causing en-masse password changing.
http://news.slashdot.org/story/15/12/14/1959231/attackers-can-hijack-joomla-sites-via-user-agent-strings#comments
All CMS are insecure, it's just knowing where the undiscovered holes are.
One of the core reasons why this issue hasn't really been prioritized is because you really shouldn't be live updating your site. Not just Drupal, but I'd argue the same for Wordpress, Joomla, whatever -- its a bad practice. Why?
Websites are very different from desktop or other normal applications. Most of these apps are tuned to your specific needs, and updates can cause issues. Serious Drupal shops and clients -never- live update their sites. Best practices suggest local or dev updates, which is then tracked by git. Site deployments should go through manual testing at a minimum. Many Drupal hosts don't even allow write access to htdocs -- only the files directory.
For those who aren't involved in the ecosystem, this article can seem alarming. But as someone who works with Drupal, and its large clients, this is a non-issue. This issue was vetted by the security team, whom are pretty risk adverse; even they didn't believe this met the criteria to be a security issue.
Should the Drupal update process be improved? Certainly. Is it a 'sky is falling Drupal sites are going to get hijacked?' nope. And for those who DO live update their drupal site, not maintain a git repo for their code, etc, etc.. Good luck. Like an default Linux install (also known to not be secure), Drupal cannot full-proof poor administrator practices.
Large organizations have large budgets to hire large and expensive teams to manage content management systems and multiple layers of added security embedded in the server and network layers. Film at 11. Now back to you, Chuck. -PCP
news for nerds
Yep. We have an internal site that's recently moved over to Drupal on the theory they won't need programmers to update it.
Updating parts of it requires editing JSON and then running a grunt process that invokes a ruby script.
Most of the actual content is imported from a database but since I guess Drupalfying it was too hard for the consultants rather than querying the database directly it recreates all the Drupal nodes every hour.
On the other hand, it's replacing a Java-based website that made liberal use of string concatenation when building database queries.
Ah, corporate IT...
Did you actually read the article, or did you just have a bad experience with Drupal (or its community)?
I agree with the GP comment about the article's concerns. That's not saying there aren't real problems with Drupal as a whole when it comes to usability for noobs, or documentation, or getting enthuiastic community support anymore (it has died off some since the D7 to D8 community schism.
But come on. It doesn't take a security team to deal with the article issues. And you don't even have to do manual testing after an update. Just use automatic CI testing (Behat, etc.) to ensure the site holds up after an update. travis-ci.org tied to a Github repo for automatic test execution with each new commit is your friend.
Finally, if you aren't using version control (such as Git) for professional web development - Drupal or not - that's irresponsible, unprofessional, and dangerous. It's like driving drunk without insurance in someone else's car. Sooner or later it's gonna catch up with you - and if you're managing a web site that does more than serve a simple brochure site, that car crash is not gonna be pretty.
Seriously - get with the times. Use Git. Learn "git clone", "git init", "git add somefile.php", "git commit", "git push", "git fetch" (and "git pull"), "git diff", "git log" "git stash", "git reset --hard HEAD~1 (or the commit's hash)" (and what --soft and --mixed mean vs. --hard), "git revert", and you're ready to do 99% of anything you'll ever need to do with Git. It's just not that hard or scary. Really. If you want ridiculously hard, try using the superfluous, bullshit Database API in Drupal 7 to anything beyond a SELECT query. Talk about a waste - was db_query() with sanitation really not good enough, Dries? Backdrop got that part right... :)
multiple layers of added security embedded in the server and network layers
You'd be surprised how often this absolutely is not the case, and possibly shocked at how often websites for household names are often relegated to side project-like status when placed up against "real" IT and/or other business concerns.
Yes, even in that lovely little list our Drupal-loving friend rattled off.
1. Drupal doesn't have an autoupdate process; all updates have to be done manually
2. Only an idiot updates a live production machine before testing any and all updates on a dev machine first
3. Once an update is tested you update by uploading from your dev server to the production server so there's no middle man
4. WTF is with this stupid FUD and the modded up idiot that knows nothing about Drupal (looking at you DNS-and-BIND)?
Drupal might be nice if you like snapshot "mine looks like his, looks like the default" websites, but that's what it amounts to. Drupal is a POS. If you want to make any non-standard change, you have to take what is already there (oh noes, never modify the original), make a copy, then hack on that. And if what you want isn't already there, then you are fucked. Been there, done that. Next come the weenies saying "but its all there!" And no its not. I spent a lot of time debugging a druapl book teaching drupal. The API had changed massively, and no one gave a shit about having something that works. Now its kinda wacked: I had built a system so that I could just drop in a new version of Drupal, and I wouldn't even have to decompress the file for the upgrade and all the extras to be upgraded (and I remember so-called 'developers' having a hard time with that. But its a poorly documented, piece of shit. Development took about 20 times a long to do even simple things as any other kind of site. "Oh, but its enterprise" and my response is "so is anything else". Its all bits flowing, and the databases are common, and the backend and the flow of bits isn't this, this is just site content, and everyone else does it too, and just as easily. The others can be as advanced (actually more so), but Druapl is crap. Why would anyone build a highway with hairpin turns and steep grades on a flat plane? But Drupal insists its the right way to go. Stupid.
As someone who has developed with Drupal for several years, I just want to add a positive perspective to balance the expected usual negative comments here. Drupal is a great CMS and web application framework. Extensible and flexible it can be adapted for many applications. Moreover, the Drupal community is knowledgeable and helpful. Growing from strength to strength with each release, I love working with Drupal. That is all.
Drupal really needs to work with Wordpress on how to do a good update process.
If there is anything Wordpress knows about, it's buggy CMS software and updating it.
Sleep your way to a whiter smile...date a dentist!
If I remember right, php didn't start checking peer ssl certs until 5.6. Then it doesn't really matter if http or https is used because php wouldn't even notice if the cert was invalid if you aren't on php >= 5.6.
Most enterprise Drupal installations (as opposed to small businesses or individuals who happen to have Drupal sites) use the following process to update:
- Have a local build script (typically using drush)
- Build locally
- Commit to git repo
- Push update to the server
Unless I'm mis-reading the article, I don't believe this process is effected by the bug described.
Fuck that. I wanted an Open Source CMS so that I could run it cheaply.
"Open Source" doesn't mean that it will run cheaply. In some cases it means just the opposite.
Also, it doesn't mean "easy". You don't have to pay for licenses, but you still need to do your homework at understanding whether a specific tool suits your use case, at a reasonable cost/effort.
Drupal is very good if you need to do something hard, like integrate with different applications, build your own modules, or you have a large number of documents, something like that. They use it at my city government, and they do great stuff, they handle a lot of data, a lot of traffic, a lot of services provided to citizens, looking great.
If you want something easy, you need something easy, like wordpress, or something hosted. It's quite cheap and easy to run. Just need the right tool.
What in the world are you trying to do with the site?
Yes, updating a drupal site is a bit of a pain (and going from major version to major version is a real pain), but other than that, it handles content creation and management just fine.
If you're getting requests from marketing to create new sections or completely new content types with fancy new functionality, then no CMS makes that part easy.
As with any piece of software, knowledge of how to use it is key. Two years ago I ported a client's Joomla e-commerce website to Drupal 7, and they were amazed at how much easier it was to update, how much faster it was, and how much their customers enjoyed it (and actually complimented the editors). Their revenue went up 1300%, and aside from a crappy inventory system that doesn't output csv files correctly, is 100% automatic where it can be. Now their subsidiaries in other countries are clamoring for a Drupal website to replace their shitty .NET CMS sites.
It's all in the experience of the developer. Unfortunately, open source means anyone can jump in and build something terrible. Apparently some of us were born knowing everything we'll ever know in life; for the rest of us who aren't blessed in that way, we can learn and make things better.
Below are some quotes of the critical issues from the blog post and the Drupal Security Team’s analysis of the risks: https://groups.drupal.org/node...