The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository UR...

An attacker can run arbitrary operating-system commands as the web-server user through insufficiently sanitised Git branch and repository URL values in the Cloud module's Kubernetes integration. This requires the Kubernetes submodule to be enabled and configured, Git to be available on the server, and the attacker to have permission to add or edit cloud server templates. Exploiting the clone path also requires the "launch cloud server template" permission, or "launch approved cloud server template" when using the approved-template flow.

Look for drupal/cloud and its version in composer.lock. The advisory lists 7.0.1 as fixed but gives no affected version range. Check whether the Kubernetes submodule is enabled and configured, whether Git is available on the server, and who can add or edit cloud server templates. For the clone path, also check who has launch cloud server template or, for the approved-template flow, launch approved cloud server template permission.

The advisory identifies these mitigating requirements: the Kubernetes submodule must be enabled and configured, Git must be available on the server, and the attacker must have permission to add or edit cloud server templates. The clone path additionally requires "launch cloud server template", or "launch approved cloud server template" in the approved-template flow.

The Cloud module enables users to manage cloud resources through Drupal.

The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary operating-system commands as the web-server user.

This vulnerability is mitigated by the fact that the Kubernetes submodule must be enabled and configured, Git must be available on the server, and an attacker must have permission to add or edit cloud server templates. Exploiting the clone path additionally requires the "launch cloud server template" permission, or the "launch approved cloud server template" permission when using the approved-template flow.