[Unpatched] Critical 0-Day RCE Exploit for vBulletin Forum Disclosed Publicly

[DDE_Server]

Content source

https://thehackernews.com/2019/09/vbulletin-zero-day-exploit.html

An anonymous hacker today publicly revealed details and proof-of-concept exploit code for an unpatched, critical zero-day remote code execution vulnerability in vBulletin—one of the widely used internet forum software.

One of the reasons why the vulnerability should be viewed as a severe issue is not just because it is remotely exploitable, but also doesn't require authentication.

Written in PHP, vBulletin is a widely used proprietary Internet forum software package that powers more than 100,000 websites on the Internet, including Fortune 500 and Alexa Top 1 million companies websites and forums.

According to details published on the Full Disclosure mailing list, the hacker claims to have found a remote code execution vulnerability that appears to affect vBulletin versions 5.0.0 till the latest 5.5.4.


The vulnerability resides in the way an internal widget file of the forum software package accepts configurations via the URL parameters and then parse them on the server without proper safety checks, allowing attackers to inject commands and remotely execute code on the system.



As a proof-of-concept, the hacker has also released a python-based exploit that could make it easier for anyone to exploit the zero-day in the wild.

So far, the Common Vulnerabilities and Exposures (CVE) number has not been assigned to the vulnerability.

The Hacker News has also informed vBulletin project maintainers about the vulnerability disclosure and expect them to patch the security issue before hackers started exploiting them to target vBulletin installations.

 

[upnorth]

This " exploit " has not yet been officially confirmed on well known data bases, so I wouldn't worry much at the moment if I was a site/forum owner.

Follow and check the official support channels will normally confirm and help a.s.a.p.

 

[[correlate]]

Anonymous researcher drops vBulletin zero-day impacting tens of thousands of sites

New zero-day could trigger a new forum hacking spree across the internet.

www.zdnet.com

 

[upnorth]

Here's an unofficial patch!

 

[upnorth]

Official patch now released.

vBulletin Security Patch Released. Versions 5.5.2, 5.5.3, and 5.5.4 - vBulletin Community Forum

<p>A security issue has been reported to the vBulletin team. To fix this issue, we have created a new security patch.</p> <p>You can download the patch for your version in the <a href="http://members.vbulletin.com/patches.php">Member's Area</a></p> <p>We have made patches

forum.vbulletin.com

 

[silversurfer]

Botnet Uses Recent vBulletin Exploit to Block Other Hackers

A botnet has been detected utilizing the recently disclosed vBulletin exploit to secure vulnerable servers so that they cannot be used by other attackers. This allows the botnet to grow their army of compromised servers without fear that other attackers will utilize the same server.

www.bleepingcomputer.com