TestBeds/CVE-2026-9082

drupal/CVE-2026-9082/README.md

@@ -0,0 +1,78 @@
+# SQL Injection in Drupal Core (CVE-2026-9082)
+
+Drupal Core versions 11.1.0 and earlier (when running on a PostgreSQL database backend) fail to properly sanitize associative array keys during entity query condition translation. A remote unauthenticated attacker can supply crafted payload array keys via JSON endpoints to execute arbitrary SQL commands.
+
+## Vulnerable Version
+
+### Setup
+
+Start Drupal version 11.3.9-apache (Vulnerable):
+
+```sh
+docker compose up -d drupal_vuln postgres_vuln
+```
+
+1. Access http://localhost:8080 in your browser.
+
+2. Complete the setup wizard with the following settings:
+
+    Language: English
+
+    Profile: Standard
+
+    Database type: PostgreSQL
+
+    Database name: drupal
+
+    Database username: drupal
+
+    Database password: drupal_password
+
+    Host: postgres_vuln
+
+    Port: 5432
+
+    Site name: Drupal Lab (Vulnerable)
+
+    Admin Username: admin
+
+    Admin Password: admin@123
+
+    Admin Email: admin@example.com
+
+## Safe Version
+
+### Setup
+
+Start Drupal version 11.3.10-apache (Safe)
+
+```sh
+docker compose up -d drupal_patched postgres_patched
+```
+1. Access http://localhost:8081 in your browser.
+
+2. Complete the setup wizard with the following settings:
+
+    Language: English
+
+    Profile: Standard
+
+    Database type: PostgreSQL
+
+    Database name: drupal
+
+    Database username: drupal
+
+    Database password: drupal_password
+
+    Host: postgres_patched
+
+    Port: 5432
+
+    Site name: Drupal Lab (Safe)
+
+    Admin Username: admin
+
+    Admin Password: admin@123
+
+    Admin Email: admin@example.com

drupal/CVE-2026-9082/docker-compose.yml

@@ -0,0 +1,85 @@
+version: '3.8'
+
+services:
+  # ==========================================
+  # VULNERABLE ENVIRONMENT (Available on Port 8080)
+  # ==========================================
+  postgres_vuln:
+    image: postgres:16
+    container_name: drupal-postgres-vuln
+    environment:
+      POSTGRES_DB: drupal
+      POSTGRES_USER: drupal
+      POSTGRES_PASSWORD: drupal_password
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data_vuln:/var/lib/postgresql/data
+    networks:
+      - drupalnet
+    restart: always
+
+  drupal_vuln:
+    image: docker.io/drupal:11.3.9-apache
+    container_name: drupal-vuln
+    depends_on:
+      - postgres_vuln
+    ports:
+      - "8080:80"
+    environment:
+      DRUPAL_DB_HOST: postgres_vuln
+      DRUPAL_DB_NAME: drupal
+      DRUPAL_DB_PORT: 5432 # Fixed: 5432 is the default for PostgreSQL
+      DRUPAL_DB_USER: drupal
+      DRUPAL_DB_PASSWORD: drupal_password
+    volumes:
+      - drupal_data_vuln:/var/www/html
+    networks:
+      - drupalnet
+    restart: always
+
+  # ==========================================
+  # PATCHED ENVIRONMENT (Available on Port 8081)
+  # ==========================================
+  postgres_patched:
+    image: postgres:16
+    container_name: drupal-postgres-patched
+    environment:
+      POSTGRES_DB: drupal
+      POSTGRES_USER: drupal
+      POSTGRES_PASSWORD: drupal_password
+    ports:
+      - "5433:5432" # Exposed on 5433 to avoid conflict with the vulnerable DB
+    volumes:
+      - postgres_data_patched:/var/lib/postgresql/data
+    networks:
+      - drupalnet
+    restart: always
+
+  drupal_patched:
+    image: docker.io/drupal:11.3.10-apache # Assuming .10 is the patched release
+    container_name: drupal-patched
+    depends_on:
+      - postgres_patched
+    ports:
+      - "8081:80" # Exposed on 8081
+    environment:
+      DRUPAL_DB_HOST: postgres_patched
+      DRUPAL_DB_NAME: drupal
+      DRUPAL_DB_PORT: 5432
+      DRUPAL_DB_USER: drupal
+      DRUPAL_DB_PASSWORD: drupal_password
+    volumes:
+      - drupal_data_patched:/var/www/html
+    networks:
+      - drupalnet
+    restart: always
+
+volumes:
+  postgres_data_vuln:
+  drupal_data_vuln:
+  postgres_data_patched:
+  drupal_data_patched:
+
+networks:
+  drupalnet: