Researcher Publishes Bypass for Patch for vBulletin -Working day Flaw

A security researcher has posted evidence-of-principle code to outsmart a patch issued last yr for a zero-working day vulnerability identified in vBulletin, a preferred software for making online neighborhood community forums.

Calling a patch for the flaw a “fail” and  “inadequate in blocking exploitation,” Austin-based mostly security researcher Amir Etemadieh released specifics and examples of exploit code on three developer platforms– Bash, Python and Ruby–for the patch in a article posted Sunday evening.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

On September 23, 2019, an unidentified security researcher released exploit code for a flaw that permitted for PHP distant code execution in vBulletin 5. by way of 5.4, Etemadieh wrote.

The zero-day, CVE-2019-16759, is known as a pre-auth RCE bug, which can enable an attacker to run malicious code and take in excess of community forums with out needing to authenticate on the web-sites that are beneath assault.

“This bug (CVE-2019-16759) was labeled as a ‘bugdoor’ mainly because of its simplicity by a popular vulnerability broker and was marked with a CVSS 3.x score of 9.8 providing it a critical rating,” he claimed in the article.

A patch was issued two times later on, Sept. 25, 2019, that “seemed, at the time, to resolve the proof of strategy exploit supplied by the un-named finder,” Etemadieh claimed.

It seems that it did not having said that, as Etemadieh outlined how it can be bypassed on the 3 developer platforms in three individual proof-of-concepts.

The key challenge with the patch issued for the zero working day is associated to how the vBulletin template process is structured and how it takes advantage of PHP, he wrote in the submit.

“Templates are not actually created in PHP but alternatively are published in a language that is to start with processed by the template engine and then is output as a string of PHP code that is afterwards ran via an eval() during the ‘rendering’ approach,” in accordance to the put up. “Templates are also not a standalone item but can be nested inside other templates, in that a single template can have a amount of youngster templates embedded within just.”

The patch is “short-sighted” for the reason that it faces issues when encountering a consumer-managed baby template, Etemadieh wrote. In this circumstance, a father or mother template will be checked to confirm that the routestring does not conclude with a widget_php route, Etemadieh said.

“However we are continue to prevented from providing a payload within the widgetConfig price mainly because of code inside of the rendering process, which cleans the widgetConfig value prior to the templates execution,” he wrote in his put up.

Etemadieh goes on to clearly show how a further template that appears in the patch is “a perfect assistant in bypassing the previous CVE-2019-16759 patch” thanks to two important characteristics: the template’s means to load a person-managed little one template, and how it hundreds the youngster template by taking a benefit from a separately named worth and inserting it into a variable named “widgetConfig.”

“These two characteristics of the ‘widget_tabbedcontainer_tab_panel’ template enable us to correctly bypass all filtering previously carried out to stop CVE-2019-16759 from remaining exploited,” he wrote.

It is unclear if Etemadieh knowledgeable vBulletin just before publishing the workarounds on the other hand, a report in ZDNet indicates that he did not. No subject, he did supply a speedy deal with for his bypass of the patch in his publish, exhibiting how to disable PHP widgets within just vBulletin forums that “may break some operation but will retain you secure from assaults until eventually a patch is unveiled by vBulletin,” he wrote.

To implement the deal with, directors really should:

On the web community forums are a popular concentrate on for hackers since of they typically have a large and numerous user foundation and keep a massive quantity of individually identifiable information and facts about those end users.

In truth, hackers squandered no time in using Etemadieh’s bypass to consider to hack into the forum at the DEF CON security convention, in accordance to a article on Twitter by DEFCON and Black Hat founder Jeff Moss. However, administrators swiftly applied Etemadieh’s guidance to disable PHP to thwart the assault, he tweeted.

“Disable PHP rendering to shield you until eventually patched!” Moss advised.

Complimentary Threatpost Webinar: Want to find out more about Private Computing and how it can supercharge your cloud security? This webinar “Cloud Security Audit: A Private Computing Roundtable” brings prime cloud-security industry experts from Microsoft and Fortanix together to examine how Confidential Computing is a recreation changer for securing dynamic cloud facts and stopping IP exposure. Sign up for us  Wednesday Aug. 12 at 2pm ET for this FREE live webinar with Dr. David Thaler, computer software architect, Microsoft and Dr Richard Searle, security architect, Fortanix – equally with the Private Computing Consortium. Register Now.