Threat Overview
Drupal Security Team advisory SA-CONTRIB-2026-254, published October 28, 2026, identifies missing authorization in the contributed Commerce Core module. Certain routes and entity fields are not sufficiently protected, potentially allowing unauthorized operations with financial consequences for merchants. Drupal explicitly confirms exploitation in the wild and advises site owners to audit orders for inconsistencies. The public advisory does **not** identify an exact vulnerable route, exploit request pattern, malicious IP, or confirmed remote-code-execution path. Accordingly the Sentinel hunts are **behavioral storefront/API and WAF pivots**, not CVE-specific signatures; they require actual HTTP URI/method logging and site-context validation.
References
- Drupal Security Team SA-CONTRIB-2026-254 (Oct 28, 2026)
- SecurityWeek analysis (Oct 30, 2026)
- The Hacker News report (Oct 30, 2026)
Impacted Systems
- Vendor/product: Drupal **Commerce Core** contributed module (`commerce`), not Drupal core itself. PHP-based Drupal e-commerce websites, on-prem/self-managed or cloud-hosted, including decoupled/API storefronts.
- Affected: Commerce Core **< 8.x-2.41** on the 2.x branch and **>=3.0.0 <3.3.13** on the 3.x branch, per the Drupal security advisory.
- Fixed: **8.x-2.41** (2.x) or **3.3.13** (3.x); later versions containing the fix are not affected by this issue.
- Prerequisite/exposure: the vulnerable Commerce module must be installed/enabled and its affected routes/fields reachable; Internet-facing storefronts have the greatest remote exposure. Drupal reports no authentication required for the flaw. No specific port beyond the site’s configured HTTP(S) service is prescribed.
- Unknown: exact exploit route(s), request body, attack IPs, affected payment providers, and the observed exploitation campaign’s scale are not disclosed.
Why this matters
Unauthorized changes to Commerce entities may alter transactions or orders even without malware or server code execution. Vendor-confirmed exploitation makes patching urgent.
Exploitation Status
**Active exploitation confirmed by Drupal (Oct 28).** The advisory does not publish attack details or IOCs. No independently verified exploit chain or customer-specific incident is asserted here.
What this hunt looks for
Write-like storefront/API requests, unusual sources, administrative route activity, WAF allow/log events, HTTP errors where mapped, and Syslog access-line fallback.
Required logs
- CommonSecurityLog: 01 — First pass: repeated commerce order or checkout mutation requests
- CommonSecurityLog: 02 — Commerce API mutation requests from unusual source addresses
- CommonSecurityLog: 03 — High-risk commerce administration path access attempts
- AzureDiagnostics: 04 — Azure WAF commerce-related requests not blocked
- Syslog: 06 — Web access lines forwarded through Linux Syslog
- CommonSecurityLog: 07 — Commerce route reconnaissance spanning multiple application areas
KQL Hunting Content
01 — First pass: repeated commerce order or checkout mutation requests
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Uri=tostring(column_ifexists("RequestURL", "")), Method=toupper(tostring(column_ifexists("RequestMethod", "")))
| where isnotempty(Uri) and Method in ("POST", "PUT", "PATCH", "DELETE")
| where Uri contains "/checkout" or Uri contains "/cart" or Uri contains "/admin/commerce" or Uri contains "commerce_order" or Uri contains "/order"
| summarize Requests=count(), Paths=dcount(Uri), Examples=make_set(Uri, 5), Methods=make_set(Method, 5) by SourceIP, DestinationIP, bin(TimeGenerated, 10m)
| where Requests >= 15 or Paths >= 5
| order by Requests desc02 — Commerce API mutation requests from unusual source addresses
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(3d))
| extend Uri=tostring(column_ifexists("RequestURL", "")), Method=toupper(tostring(column_ifexists("RequestMethod", "")))
| where Method in ("POST", "PUT", "PATCH", "DELETE") and (Uri contains "commerce_order" or Uri contains "/jsonapi/")
| summarize by SourceIP, DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(3d)
| extend Uri=tostring(column_ifexists("RequestURL", "")), Method=toupper(tostring(column_ifexists("RequestMethod", "")))
| where Method in ("POST", "PUT", "PATCH", "DELETE") and (Uri contains "commerce_order" or Uri contains "/jsonapi/")
| join kind=leftanti (Baseline) on SourceIP, DestinationIP
| project TimeGenerated, SourceIP, DestinationIP, Method, Uri, DeviceAction, Activity
| order by TimeGenerated desc03 — High-risk commerce administration path access attempts
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Uri=tostring(column_ifexists("RequestURL", "")), Method=toupper(tostring(column_ifexists("RequestMethod", "")))
| where Uri contains "/admin/commerce" and Method in ("POST", "PUT", "PATCH", "DELETE")
| summarize Attempts=count(), Urls=make_set(Uri, 8), Actions=make_set(DeviceAction, 5) by SourceIP, DestinationIP, bin(TimeGenerated, 1h)
| order by Attempts desc04 — Azure WAF commerce-related requests not blocked
AzureDiagnostics
| where TimeGenerated >= ago(14d)
| where Category has "Firewall" or Category contains "WAF"
| extend Uri=tostring(column_ifexists("requestUri_s", "")), Action=tostring(column_ifexists("action_s", "")), ClientIP=tostring(column_ifexists("clientIP_s", "")), RuleId=tostring(column_ifexists("ruleId_s", ""))
| where Uri contains "/checkout" or Uri contains "/admin/commerce" or Uri contains "commerce_order" or Uri contains "/cart"
| where Action !in~ ("Blocked", "Block", "Deny")
| project TimeGenerated, Resource, Category, ClientIP, Uri, Action, RuleId
| order by TimeGenerated desc06 — Web access lines forwarded through Linux Syslog
Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage contains "POST " or SyslogMessage contains "PATCH " or SyslogMessage contains "PUT " or SyslogMessage contains "DELETE "
| where SyslogMessage contains "/checkout" or SyslogMessage contains "/cart" or SyslogMessage contains "commerce_order" or SyslogMessage contains "/admin/commerce"
| project TimeGenerated, Computer, Facility, ProcessName, SyslogMessage
| order by TimeGenerated desc07 — Commerce route reconnaissance spanning multiple application areas
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Uri=tostring(column_ifexists("RequestURL", ""))
| where Uri contains "/checkout" or Uri contains "/cart" or Uri contains "/admin/commerce" or Uri contains "/jsonapi/" or Uri contains "/user/"
| extend Area=case(Uri contains "/admin/commerce", "commerce-admin", Uri contains "/jsonapi/", "jsonapi", Uri contains "/checkout", "checkout", Uri contains "/cart", "cart", "user")
| summarize Areas=dcount(Area), Requests=count(), Samples=make_set(Uri, 8) by SourceIP, DestinationIP, bin(TimeGenerated, 15m)
| where Areas >= 4 and Requests >= 15
| order by Areas desc, Requests descDetection Notes
- Highest practical value: unusual write-like traffic to Commerce routes combined with source rarity and known store inventory; none is a vulnerability-specific signature.
- No public exploit route is confirmed; `/checkout`, `/cart`, `/admin/commerce`, and `commerce_order` are general commerce pivots, not asserted exploit paths.
- The HTTP status query depends on a verified vendor mapping to `DeviceCustomNumber1`; it must be adapted before use if that mapping is absent.
- Legitimate checkout activity, API clients, crawlers and payment processors create substantial noise. An HTTP 200/allowed WAF event does not establish authorization bypass.
- Order integrity must be validated against application/database records by the customer; these records are not assumed present in Sentinel.
- Do not infer absence of exploitation from no WAF hits; missing decrypted URI/method data and retention gaps are major limitations.
- 01 — First pass: repeated commerce order or checkout mutation requests: Behavioral screening, not an exploit signature. Legitimate carts and payment integrations generate POSTs; URI and method must be logged.
- 02 — Commerce API mutation requests from unusual source addresses: Looks for novel sources performing writes; no public exploit path has been confirmed, and JSON:API is not necessarily enabled.
- 03 — High-risk commerce administration path access attempts: Admin-route access is not the disclosed vulnerable route; this is a high-value related-access pivot only. Authorization status cannot be inferred from WAF logs.
- 04 — Azure WAF commerce-related requests not blocked: A WAF Allow/Log/Count record does not mean authorization bypass succeeded. Field names vary between Azure WAF resources and resource-specific tables.
- 06 — Web access lines forwarded through Linux Syslog: Only works when HTTP access logs are explicitly forwarded into Syslog; ordinary Linux system logs do not provide this visibility.
- 07 — Commerce route reconnaissance spanning multiple application areas: Broad path enumeration may be legitimate browser activity, crawlers, or scanners; prioritize clients without authenticated storefront context.
