0

I recently noticed that all of my sites have the file xmlrpc.php.

Searching it led me to "Gain Control of WordPress by Exploiting XML-RPC", and also to "Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-001".

I'm running Drupal 7.56.

Does this file pose a threat whatsoever to my site? Should I just delete it to be safe?

If I should keep it, what added benefit does it give me?

Improve this question
1

You are save. At least to what we know now.

The first linked article is wordpress related. This is totally different code. Not drupal related at all!

Drupal had a known security flaw in versions lower than 6.38 / 7.43 / 8.04

So your version 7.56 is patched. Always make sure to update to the latest version and you're good.

Improve this answer
5
  • Thanks for the quick reply! While I am inclined to agree, it does seem like the file can lead to a vulnerability. In regards to the original vulnerability via the 2016 SA Core: "This vulnerability is mitigated by the fact that you must have enabled a module that provides an XML-RPC method that is vulnerable to brute-forcing." If I enable a module that, unknown to my knowledge, utilizes this file, I'll be putting myself at risk, no? Apologies in advance if I'm misunderstanding anything. :) – n0t_5o_paRan01d Aug 31 '17 at 19:45
  • You're putting yourself at the same risk every time you use any bit of software @Brian, they all have potential security holes. For this one specifically, the brute-force vulnerability was patched so assuming you have a version later than that, you're fine, unless a new vulnerability is discovered. Hopefully it won't be, but there's always the chance there will be. Same could be said about index.php, which serves most of Drupal (google "Drupalgeddon" for a fun story if you're not already familiar with the term). If the risk is unacceptable to you, delete the file :) – Clive♦ Aug 31 '17 at 19:50
  • Thanks for the reply @Clive! As it turns out, I believe I was misreading the SA Core; as it read "This vulnerability is mitigated by ... vulnerable to brute-forcing," I was under the impression that that was Drupal's fix. Going to the official changelog for the newest version cleared that up for me, along with your answer! Thanks again. :) – n0t_5o_paRan01d Aug 31 '17 at 19:51
  • Oh and just to clarify, the mitigating factor applies to installs of Drupal that don't have the patch. They're basically saying "there's a nasty security vulnerability in v7.43, but even in 7.43 you have to have certain types of module enabled, otherwise the vulnerability isn't exploitable. Once you upgrade to 7.44+, the vulnerability won't be there for anyone" – Clive♦ Aug 31 '17 at 19:53
  • You caught me right in the middle of trying to explain just that ;) – Clive♦ Aug 31 '17 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.