Drupal security audit: technical analysis for institutional and enterprise organisations
By Kike Gandia · Co-Founder & CEO, OSCP
Drupal is the CMS of choice for public administrations, universities, media outlets and complex organisations that need advanced control over content, roles and publishing workflows. Its robustness as a platform does not eliminate security risks: third-party modules, custom configurations and the complexity of the environment are attack vectors that require specific analysis.
Drupal in complex organisations: a specific attack surface
A typical enterprise Drupal installation includes dozens of contrib modules, custom development, integrations with internal systems (LDAP, SSO, ERP), complex user roles and a hosting environment that may span multiple servers, CDNs and load balancers. This complexity widens the attack surface beyond what a generic analysis can cover.
Drupalgeddon (CVE-2014-3704) and Drupalgeddon2 (CVE-2018-7600) are the best-known examples of critical core vulnerabilities with massive impact. But most current Drupal compromises occur through outdated contrib modules or misconfigurations.
What a Drupal security audit covers
- Core and contrib module versions against the Security Advisories history from the Drupal security team
- Analysis of custom modules: PHP code, hooks, forms, database access and permission control
- Review of Drupal's roles and permissions system: configuration complexity and possible privilege escalation
- Testing of the login form and authentication system: brute force, enumeration and bypass
- Analysis of Drupal's REST API and JSON:API: endpoints accessible without authentication and access control
- Review of integrations: LDAP/Active Directory, SSO (SAML, OAuth), file systems and external storage
- Server configuration: file permissions, access to sensitive directories (/sites/default/settings.php) and HTTP headers
Compliance and ENS in public organisations running Drupal
Spanish and European public administrations that use Drupal are subject to the National Security Framework (ENS) or equivalent regulations. A Drupal security audit produces the technical pentesting evidence required for ENS certification processes and to meet the standard's web application security controls.
FAQ
Is the audit compatible with Drupal 7, 9 and 10?
Yes, although Drupal 7 has reached official end of support. If your organisation is still on Drupal 7, the audit documents the version-specific risk of running EOL software and prioritises migration as part of the remediation plan.
Does the audit include a review of the workflow and publishing modules?
Yes. Workflow, content moderation and publishing modules are components with complex access-control logic that may contain privilege escalation between editorial roles.
What does a Drupal site audit evaluation actually deliver?
A prioritised findings report (each issue rated by exploitability and business impact), proof-of-concept evidence for anything exploitable, and a remediation plan mapped to your module/contrib inventory — not just a vulnerability scan output. A free re-test after fixes is included.
Related service
Related content
- CMS pentesting service
- WordPress penetration testing
- PrestaShop module security
- Common vulnerabilities in enterprise CMS