CVE-2014-3704: Emergency Security Patch for Drupal (Drupalgeddon)

If you cannot immediately upgrade your Drupal site to version 7.32 or later, this guide will walk you through manually applying the official security patch as an emergency mitigation.

For the technical analysis of the underlying SQL-injection bug, see CVE-2014-3704 — Drupalgeddon SQL Injection Vulnerability (technical breakdown of expandArguments()).

Critical Vulnerability Overview

• CVE ID: CVE-2014-3704
• Drupal Advisory: SA-CORE-2014-005
• Affected Versions: Drupal 7.x versions before 7.32
• Vulnerability Type: SQL Injection via the expandArguments() function in the database API.
• Impact: Allows unauthenticated attackers to execute arbitrary SQL code on your database, leading to administrator account creation, data exfiltration, code execution, and complete site takeover.

Prerequisites & Backup

Before touching any files, create comprehensive backups to ensure you can recover in case of errors.

1. Backup Your Site Files

tar -czvf drupal_backup_$(date +%Y%m%d).tar.gz /path/to/your/drupal/installation

2. Backup Your Database

mysqldump -u YOUR_DB_USER -p YOUR_DATABASE_NAME > drupal_db_backup_$(date +%Y%m%d).sql

3. Identify Your Drupal Version

Confirm you are running a vulnerable version.

cd /path/to/drupal
drush status | grep "Drupal version"
# OR check manually:
cat includes/bootstrap.inc | grep "define('VERSION'"

If the version is less than 7.32 (e.g., 7.31, 7.30), proceed.

Download the Official Patch

Download the patch file directly from the official Drupal security team.

cd /path/to/drupal
wget https://www.drupal.org/files/issues/SA-CORE-2014-005.patch
# OR using curl:
curl -O https://www.drupal.org/files/issues/SA-CORE-2014-005.patch

Verify the file was downloaded:

ls -la SA-CORE-2014-005.patch

Apply the Patch

1. Navigate to Your Drupal Root

cd /path/to/your/drupal/installation

2. Apply the Patch

patch -p1 < SA-CORE-2014-005.patch

Expected Successful Output:

patching file includes/database/database.inc
patching file includes/database/mysql/database.inc
patching file includes/database/pgsql/database.inc

3. Clear Drupal Cache

Clear all caches to ensure the patched code is loaded.

drush cache-clear all
# If you don't have Drush:
# 1. Log into Drupal admin
# 2. Go to Configuration > Performance
# 3. Click "Clear all caches"

Verify & Test the Patch

1. Verify the Patch Was Applied

Check the modified file to confirm the security fix is in place.

grep -n "is_array" includes/database/database.inc

You should see new lines added around the expandArguments() function that include array checking logic.

2. Test Site Functionality

1. Browse your website as a normal user.
2. Log in as an administrator and check the admin panels.
3. Test any critical forms (user login, contact forms, search).

3. Check Error Logs

# Check Drupal watchdog logs (via Drush)
drush watchdog-show --count=20

# Check recent PHP/Apache/Nginx errors
sudo tail -50 /var/log/apache2/error.log
# OR
sudo tail -50 /var/log/nginx/error.log

Monitor for Exploitation Attempts

Attackers aggressively scanned for and exploited this vulnerability. Check your logs for signs of compromise.

1. Search for Exploitation Patterns in Web Server Logs

sudo grep -i "SA-CORE-2014-005\|CVE-2014-3704\|expandArguments" /var/log/apache2/access.log
# Look for suspicious query patterns:
sudo grep -E "(node.*destination|uid\[.*\]\[table\]=users)" /var/log/apache2/access.log

2. Check for Unexpected Administrator Users

# In your database:
mysql -u root -p -e "SELECT uid, name, mail, created FROM users WHERE name LIKE '%admin%' OR name LIKE '%test%' ORDER BY created DESC LIMIT 10;" drupal_database

3. Indicators of Compromise (IoC)

• New, unexpected administrator users (especially created around the time of the vulnerability disclosure in October 2014).
• Unknown or modified PHP files in the sites/ directories.
• Unexpected cron jobs or database entries.

Linux VDS

High performance for your projects

• Root access and flexible setup
• Control panel
• NVMe disks
• DDR5

View pricing

Additional Hardening Measures

While waiting for a full upgrade, implement extra layers of defense.

1. Restrict Access with .htaccess (Apache)

If the site is for internal use, restrict IP access in your Drupal root .htaccess:

Order deny,allow
Deny from all
Allow from 192.168.1.0/24   # Your office network
Allow from 203.0.113.5      # Your static IP
Allow from 2001:db8::/32    # Your IPv6 range

2. Implement a Web Application Firewall (WAF)

• Cloudflare: Enable WAF rules and block SQL injection patterns.
• Sucuri: Site-level WAF and monitoring.
• ModSecurity: Open-source WAF for Apache/Nginx.

3. File Integrity Monitoring

# Generate checksums of core files after patching
find . -name "*.php" -type f -exec md5sum {} \; > /root/drupal_patched.md5
# Later, verify they haven't changed:
md5sum -c /root/drupal_patched.md5 2>/dev/null | grep -v "OK"

Summary

By following this guide, you can urgently mitigate the Drupalgeddon vulnerability while preparing for the necessary full upgrade to secure your website long-term.