CVE-2020-17496

CVE-2020-17496 is an unauthenticated remote command execution flaw in vBulletin 5 (CWE-74, improper command neutralization) that exists because the vendor's fix for the earlier CVE-2019-16759 was incomplete. An attacker triggers it by sending a request to the ajax/render/widget_tabbedcontainer_tab_panel route with crafted subWidgets data, which the application processes without adequate sanitization. Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary commands on the web server with the privileges of the web application, enabling site compromise, data theft, or deployment of webshells or botnet malware. All vBulletin deployments running versions 5.5.4 through 5.6.2 are affected. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), public proof-of-concept exploits and a detailed public analysis exist, and EPSS estimates an 87.7% probability of exploitation within 30 days; ransomware association is listed as unknown.

What to do: Upgrade vBulletin to a release newer than 5.6.2 following the vendor's update instructions, as required by CISA's KEV listing. As an interim mitigation, restrict or block access to the ajax/render route (e.g., via WAF rules). Given confirmed in-the-wild exploitation, review web server logs for requests to ajax/render/widget_tabbedcontainer_tab_panel with crafted subWidgets parameters and check for signs of compromise such as webshells or unexpected processes running as the web server user.