vBulletin released patches for an undisclosed security vulnerability, encouraging users to apply the patch as soon as possible.
Update 05/12/20: Updated the Analysis and Proof of concept section to reflect the availability of PoCs from a vulnerability researcher.
On May 7, vBulletin, a popular online forum software, announced a patch for a security vulnerability in its software. While details have not yet been disclosed, vBulletin said it is “imperative” that users of their software patch the vulnerability as soon as possible. Based on what we've seen from previous vBulletin vulnerabilities, we anticipate attackers will attempt to attack vulnerable sites as soon as details become available.
CVE-2020-12720 is an access control related issue in the vBulletin software. Full details about the flaw are not yet public. However, Charles Fol, a security engineer at Ambionics who reported the vulnerability, has tweeted that CVE-2020-12720 is “critical” and that users should patch their software. Fol plans to provide further information about the flaw during the SSTIC conference from June 3-5.
vBulletin sites were attacked in less than 24 hours after CVE-2019-16759, a remote code execution flaw, was anonymously disclosed via the SecLists.org security mailing list in September 2019. Therefore, it’s reasonable to assume that attackers will attempt to reverse engineer the patch and craft exploit code based on what the security patches change in vBulletin’s code.
Patch diffing reveals vulnerability details
On May 8, vulnerability researcher Amir Etemadieh tweeted that he was diffing the changes in vBulletin version 5.6.1 vs. 5.6.1 PL1. In his initial analysis, Etemadieh said that while hunting for incorrect access control flaws, he was only able to identify SQL injection flaws instead.
I'm diffing the changes for CVE-2020-12720 in vBulletin 5.6.1 vs 5.6.1 PL1 and while the CVE is marked as an "incorrect access control" vulnerability all I currently see is 2 fixes for SQLi vulns. 1/5https://t.co/DTz6KG8tky— Amir Etemadieh (@Zenofex) May 9, 2020
On May 12, Etemadieh posted a Twitter thread containing PoCs for unauthenticated SQL injection flaws to obtain the admin user as well as the admin user’s security token from a vulnerable vBulletin instance.
Looks like vB was actually patching a SQL injection vuln with the latest round of patches in vBulletin 5.6.1. Here's an unauthenticated SQLi PoC— Amir Etemadieh (@Zenofex) May 12, 2020
curl "http://localhost/vb5/ajax/api/content_attach/getIndexableContent" -H 'X-Requested-With: XMLHttpRequest' -d "nodeId[nodeid]=SQLi"
Etemadieh plans to provide further information in a write-up, optimizing his exploit while digging further into the patch differences.
Proof of concept
At the time this blog was published, no proof-of-concept (PoC) code was available for this vulnerability. On May 12, vulnerability researcher Amir Etemadieh publicly shared PoCs for unauthenticated SQL injection against a vulnerable vBulletin instance. We still expect more information to become available following Fol’s talk at SSTIC in early June.
Users can download respective patches for the following versions in the Member’s Area of the vBulletin forums:
- 5.6.1 Patch Level 1
- 5.6.0 Patch Level 1
- 5.5.6 Patch Level 1
Users of vBulletin Cloud sites have already had the patch applied and do not need to take any action.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.