vBulletin zero-day exploited in the wild in wake of exploit release
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-16759 | Pre-Authentication Remote Code Execution in vBulletin 5.x CVE-2019-16759 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in vBulletin 5.x through 5.5.4 (CWE-94, code injection) in the PHP widget rendering component. An attacker triggers it by sending a crafted request to the 'ajax/render/widget_php' routestring with a malicious PHP payload in the widgetConfig[code] parameter, requiring no credentials or user interaction. Successful exploitation yields remote command execution on the web server as the web application user, enabling full compromise of the forum, theft or modification of its user database, and a foothold for further network access. Any site running vBulletin 5.x through 5.5.4 is affected, and exploitation is confirmed in the wild: the flaw was attacked as a zero-day after public exploits appeared, with headline-reported compromises including the Comodo Forums breach affecting about 245,000 users and the ZoneAlarm forum hack, and botnets observed exploiting the flaw. It is listed in CISA KEV (added 2021-11-03) with a 99.7% EPSS score, indicating near-certain near-term exploitation probability. Do: Upgrade vBulletin to a release newer than 5.5.4 (the patched 5.5.x version per vendor instructions), as required by the CISA KEV action. As an interim mitigation, block or filter requests to the 'ajax/render/widget_php' routestring (or strip the widgetConfig[code] parameter) at the web server or WAF. Because exploitation requires no authentication and public PoC exploits are widely available, assume compromise and check logs for requests to ajax/render/widget_php containing widgetConfig[code], and investigate any forum for signs of data theft or web shell implantation. | 9.8 | 100% | KEV PoC ×9 |
| largetens of thousands of internet-exposed vBulletin 5.x forum installations (plausibly 10k–100k+ sites, translating to hundreds of thousands to millions of forum… |
Full article370 words · extracted from helpnetsecurity.com · click to collapse
An anonymous bug hunter has released a working and elegantly simple exploit for a pre-authentication remote code execution flaw (CVE-2019-16759) affecting vBulletin and it didn’t take long for attackers to start using it.
About vBulletin
vBulletin is the most popular internet forum software in use today.
W3Techs says that around 0.1% of all internet sites run a vBulletin forum, though only 6.4% of these use vulnerable 5.x versions.
MH Sub I, the company that develops vBulletin, claims that there are over 100,000 sites built on the forum software. Among its customers are EA, Sony Pictures, Steam, NASA, Zynga, and many others.
Many dark web forums that serve as markets for illicit services are also based on vBulletin.
About the vulnerability (CVE-2019-16759)
CVE-2019-16759 affects vBulletin versions 5.0.0 to 5.5.4. The release of the exploit has apparently caught the company developing the software unawares: they have yet to comment the situation or push out a fix.
The flaw allows unauthenticated, remote attackers to send a specially crafted HTTP POST request to a vulnerable vBulletin host and execute commands.
“These commands would be executed with the permissions of the user account that the vBulletin service is utilizing. Depending on the service user’s permissions, this could allow complete control of a host,” Tenable researcher Ryan Seguin noted.
Though the vBulletin team has still not acknowledged the existence of the vulnerability, the effectiveness of the exploit has been confirmed by many security researchers.
Some members of vBulletin’s own online forums have called on the team to release an out-of-band patch as soon as possible, and warned about ongoing attacks exploiting the flaw.
According to one of the users, attackers are trying to install PHP web-shells on the vulnerable hosts (servers).
What to do?
While users are waiting for an official patch and/or mitigation advice from the vBulletin team, they can try implementing a tentative patch provided by Nick Cano, Senior Architect at Cylance, with the caveat that it might break some functionality.
Alternatively, they could temporarily take down their forums or mitigate exploitation risk by putting them behind a web application firewall.
UPDATE (October 1, 2019, 5:40 a.m. PT): Attackers have exploited CVE-2019-16759 to access to the user database of some Comodo’s online forums.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/09/25/cve-2019-16759/