Researcher discloses exploit code for a vBulletin zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-16759 | Pre-Authentication Remote Code Execution in vBulletin 5.x CVE-2019-16759 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in vBulletin 5.x through 5.5.4 (CWE-94, code injection) in the PHP widget rendering component. An attacker triggers it by sending a crafted request to the 'ajax/render/widget_php' routestring with a malicious PHP payload in the widgetConfig[code] parameter, requiring no credentials or user interaction. Successful exploitation yields remote command execution on the web server as the web application user, enabling full compromise of the forum, theft or modification of its user database, and a foothold for further network access. Any site running vBulletin 5.x through 5.5.4 is affected, and exploitation is confirmed in the wild: the flaw was attacked as a zero-day after public exploits appeared, with headline-reported compromises including the Comodo Forums breach affecting about 245,000 users and the ZoneAlarm forum hack, and botnets observed exploiting the flaw. It is listed in CISA KEV (added 2021-11-03) with a 99.7% EPSS score, indicating near-certain near-term exploitation probability. Do: Upgrade vBulletin to a release newer than 5.5.4 (the patched 5.5.x version per vendor instructions), as required by the CISA KEV action. As an interim mitigation, block or filter requests to the 'ajax/render/widget_php' routestring (or strip the widgetConfig[code] parameter) at the web server or WAF. Because exploitation requires no authentication and public PoC exploits are widely available, assume compromise and check logs for requests to ajax/render/widget_php containing widgetConfig[code], and investigate any forum for signs of data theft or web shell implantation. | 9.8 | 100% | KEV PoC ×9 |
| largetens of thousands of internet-exposed vBulletin 5.x forum installations (plausibly 10k–100k+ sites, translating to hundreds of thousands to millions of forum… |
Full article409 words · extracted from securityaffairs.com · click to collapse
A researcher published details and proof-of-concept exploit code for a zero-day RCE vulnerability in the popular forum CMS vBulletin.
The researcher Amir Etemadieh has published technical details and proof-of-concept exploit code for a zero-day remote code execution vulnerability in vBulletin, the popular forum software.
The new vulnerability is a bypass for a the security patch released by a vBulletin for the CVE-2019-16759 flaw, disclosed in September 2019.
The previous vulnerability could be exploited remotely by an unauthenticated attacker. The PoC exploit published by the hacker works on vBulletin versions 5.0.0 till the latest 5.5.4.
The flaw resides in the way an internal widget file of the forum software package accepts configurations via the URL parameters. The expert discovered that the package fails to validate the parameters, an attacker could exploit it to inject commands and remotely execute code on the vulnerable install.
The CVE-2019-16759 flaw was publicly disclosed on September 24, 2019, the maintainer of the vBulletin CMS released the security patch on September, 25.
Now the researcher Amir Etemadieh explained that the patch initially released did no completely fix the issue.
“Today, we’re going to talk about how the patch that was supplied for the vulnerability was inadequate in blocking exploitation, show how to bypass the resulting fix, and releasing a bash one-liner resulting in remote code execution in the latest vBulletin software.” reads a blog post published by Etemadieh.
The experts found a trivial way to bypass the patch, it released three three proof-of-concept exploits in Bash, Python, and Ruby
Etemadieh did not report the issue to the vBulletin team before the public disclosure of the flaw.
The exploit code is rapidly circulating on social media and inside hacking forums, for this reason, experts fear that threat actors will start using it in massive attacks.
The vBulletin team has already released a security patch to address this new zero-day vulnerability, anyway forum owners can also apply the following short term fix:
- Go to the vBulletin administrator control panel.
- Click “Settings” in the menu on the left, then “Options” in the dropdown.
- Choose “General Settings” and then click “Edit Settings”
- Look for “Disable PHP, Static HTML, and Ad Module rendering”, Set to “Yes”
- Click “Save”
At the time of publishing, at least one vBulletin-based forum has been hacked using this new zero-day, it is the site of the popular DEF CON security conference.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, vBulletin)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/106998/breaking-news/vbulletin-zero-day.html