Category: IT|Aug 15, 2020 | Author: Admin

vBulletin Zero-Day Surfaces Online Following Patch Bypass

Share on

Recently, vBulletin addressed a zero-day vulnerability that was quickly exploited. The bug appeared as a result of bypassing the patch for a previously known and fixed vulnerability.

vBulletin Zero-Day Due To Failed CVE-2019-16759 Fix Reportedly, in 2019, a security researcher discovered a critical vulnerability in vBulletin 5.0 to 5.4. As revealed through the full disclosure, the bug could allow PHP remote code execution upon exploitation.

It received the CVE ID CVE-2019-16759 with a critical severity rating and a CVSS score of 9.8. Within three days of disclosure, the vendors deployed a fix for the flaw. However, recently, another security researcher Amir Etemadieh discovered that the fix had a security issue and could find a way to bypass the patch and exploit the flaw. He even shared the PoCs for it in Bash, Python, and Ruby.

Sharing the details in a blog post, the researcher revealed that the problems existed in the vBulletin template structure. As stated,

Specifically, templates aren’t actually written in PHP but instead are written in a language that is first processed by the template engine and then is output as a string of PHP code that is later ran through an eval() during the “rendering” process.

Furthermore, the templates could have numerous child templates after being nested. This structure triggered numerous security bugs. A bug in one template could expose other code too, including the parent template. Thus, the researcher could bypass the fix by exploiting the template “widget_tabbedcontainer_tab_panel” that had two features.


1. The templates ability to load a user controlled child template.
2. The template loads the child template by taking a value from a separately named value and placing it into a variable named “widgetConfig”.

He has also shared a detailed presentation for anyone to test the exploit. vBulletin Released Another Patch Upon discovering the flaw, the researcher did not disclose the vulnerability privately to the vendors and instead disclosed the details online. Shortly after the disclosure, attackers exploited the vulnerability to hack the DEFCON forum.

 

Sponsored Ads:

Comments:


Now Tesla can do something completely new

Category: General|Jul 4, 2022 | Author: Admin

"Google pushes users into comprehensive monitoring"

Category: Google|Jul 3, 2022 | Author: Admin

In this country, Apple must comply with the new iPhone law

Category: Apple|Jul 2, 2022 | Author: Admin

Are you tired of iPhone? Now Google makes it easy

Category: Google|Jul 1, 2022 | Author: Admin

The EU extends its 'Roam-like-at-home' mobile service rule through 2032

Category: IT|Jun 30, 2022 | Author: Admin

Apple's important iPhone project may have failed

Category: Apple|Jun 29, 2022 | Author: Admin

Dramatic Netflix message: announces they are losing two million customers

Category: General|Jun 28, 2022 | Author: Admin

This is how mobile cameras get better with a shrunken Samsung sensor

Category: IT|Jun 27, 2022 | Author: Admin

Now the PlayStation 5 screens come with 4K and 144Hz

Category: General|Jun 26, 2022 | Author: Admin

AirPods get better sound quality - much about AirPods Pro 2 revealed

Category: Apple|Jun 25, 2022 | Author: Admin

The day is here: all you have to do is launch your Playstation

Category: General|Jun 24, 2022 | Author: Admin

This card holds the record

Category: IT|Jun 23, 2022 | Author: Admin

Russians refuse to download Windows 11 and 10

Category: Microsoft|Jun 22, 2022 | Author: Admin

Tesla is banned in this city

Category: General|Jun 21, 2022 | Author: Admin

Everyone with Sonos must know the super-tricks this button can

Category: IT|Jun 20, 2022 | Author: Admin
more