vBulletin 5 widget_php Pre-Auth RCE
- Product
- vBulletin (MH Sub I) vBulletin 5
- CVE
- CVE-2019-16759
- Disclosed
- 2019-09-23
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- 5.0.0 - 5.5.4
- Fixed
- 5.5.2 PL1, 5.5.3 PL1, 5.5.4 PL1 (bypass CVE-2020-17496 fixed in 5.6.2 PL1 etc.)
Summary
An anonymous researcher dropped a 0-day exploit on Full Disclosure: one POST to any vBulletin 5 forum with routestring=ajax/render/widget_php runs PHP code. Its patch was itself bypassed in August 2020 (CVE-2020-17496).
Root cause
The ajax/render route let unauthenticated users render arbitrary templates, including widget_php, which evals the widgetConfig[code] parameter. The 2020 bypass used the widget_tabbedcontainer_tab_panel template to pass subWidgets data into the same widget_php eval.
Impact
Unauthenticated RCE on vBulletin 5.x forums.
Public PoC
params = {"routestring":"ajax/render/widget_php"}
params["widgetConfig[code]"] = "echo shell_exec('"+cmd+"'); exit;"
r = requests.post(url = sys.argv[1], data = params)Source: Full Disclosure 2019-09-23 (anonymous)
Detection
Search logs for 'routestring=ajax/render/widget_php' or 'widget_tabbedcontainer_tab_panel' with widgetConfig parameters. nuclei template CVE-2019-16759.
Mitigation
Apply vBulletin patches (5.6.2 PL1+), or disable PHP widgets (Settings > Options > Disable PHP, Static HTML and Ad module rendering).