High-severity vulnerability in vBulletin is being actively exploited

https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/

by bifrost • 7 years ago

111 59 7 years ago

arstechnica.com

giancarlostoro• 7 years ago

I find it so weird that they call this a commenting system. It is a forum or message board. Last thing I would call it is a commenting system. Never heard anybody calling vBulletin a commenting system.

WaxProlix• 7 years ago

Yeah seems weird. Is there an embedded version (like uh, I think Quora does this) that you can use? I've only ever seen it in standalone message board/forum contexts.

foota• 7 years ago

You might be thinking of disqus?

ceejayoz• 7 years ago

When I last used it (years ago) there was a neat plugin that'd let you use it as a commenting system for a WordPress blog. Every blog post would get a new thread in a particular forum, and people could comment in both places.

basilgohar• 7 years ago

I remember using or seeing something very similar for phpBB (a free software bulletin board web app). I think that kind of functionality existed for most extensible boards.

floren• 7 years ago

In 2019, people are confused at the idea of simply posting discussion without it being a little appendix to some piece of content (a Youtube video, a news article, a blog post)

big_chungus2• 7 years ago

I spun up a trial instance just for fun, and indeed, it's as easy and fool-proof as it sounds. This is something where some one can run some google dorks for the right forum and throw results into a twenty-line script.

Interestingly enough, it appeared as though google somehow sanitized the dork proposed in the actual post to return few to no forums, at least when I checked this morning. Checking now from a different IP returns a lot more; very weird.

The actual post to seclists for reference: https://seclists.org/fulldisclosure/2019/Sep/31

Also, why on God's green earth to devs put version numbers so obviously in the software? For instance, on my web servers, I always turn off version number and platform, so an attacker can't easily go hunt down vulns from scraping the web. It seems as though it would be wise to make no version numbers that easily accessible the default.

bluedino• 7 years ago

Probably easier to just try the whole bag of exploits

lbotos• 7 years ago

You are advocating for security by obscurity. Which is a "deterrent" not a solution.

Version numbers help people get support and know when/where versions are fixed and if they are patched/updated.

A solution is running up to date software, and encouraging developers to release security fixes and for admins to care.

shakna3• 7 years ago

Version numbers can still be handed to people without having to appear in every single request.

It is a deterrent, and not a solution. But it does prevent the clouds of botnets from labeling you as definitely vulnerable and attacking you the moment a new 0-day gets purchased. The speed of attacks can outpace your speed of your upgrade process.

Security-in-depth should always be the way forward. This is just another tickbox you can use.

big_chungus2• 7 years ago

I'm not advocating for using it as a sole defense, I'm saying it can cut down on log noise and won't hurt. Relying on security by obscurity is stupid; reducing the amount of information available to an attacker is smart.

newnewpdro• 7 years ago

They're doing nothing of the sort.

All software will have bugs.

There's no good reason to accurately broadcast to the world what specific version you're running of anything, ever.

It's not advocating leaving your production systems to rot with ancient software because you've hidden the versions. You still need to stay vigilant. But the reality is, 0-days happen, and not all bugs being exploited are reported/fixed. Keep the version hidden, or hell, broadcast a completely different software/version altogether.

mcpherrinm• 7 years ago

I tried the Google dork search on Tuesday morning when I saw the Full Disclosure email.

At that time, a lot of servers showed up. All the top ones had been vandalized already.

itcrowd2• 7 years ago

“Zerodium customers were aware of it since 3 years.”

This is why we can't have nice things. Zerodium, thanks for being honest, but services such as yours are actively making the internet a worse place.

allset_• 7 years ago

I'm surprised it took this long to be found. Searching for shell_exec() and/or exec() in the source would be the first thing I'd do if looking for RCE.

shakna3• 7 years ago

Well it was

    eval($code);

so it's even worse. Those two wouldn't show up, but you can call them if you want to!

rolltiide• 7 years ago

I think the anonymous researcher that disclosed it more broadly now is the one making the internet a worse place

Why do our opinions differ?

notzuck2• 7 years ago

As someone that has sold exploit code to various brokers in the past, I don't think Zerodium are making the internet a worse place. I forget the exact year but it was around 2004 - 2006 one of my friends reported a vuln to phpbb, they openly mocked her and downplayed the issue with no fix. She put together a professional looking report on how it works and submitted it privately to the product team, she was then ignored and banned from their IRC. She then published the exploit publicly and they sued her, they forced her ISP to take punitive action and they contacted her college to try and get her suspended.

Fuck reporting vulns, fuck open disclosure. Just sell what you find to brokers.

Cahouki Bekrar says there are three options:

1. Full disclosure so anyone/Govs can (ab)use it without limits/regulation

2. Sell to Govs/brokers and get a decent revenue while limiting (ab)use

3. Report to vendors & get sued, or get shitty bounties and/or your name in advisories

I agree with him.

ozim• 7 years ago

Cannot upvote this enough. Finding vuln is one thing, other thing is power structures, politics, people feelings in companies or oss projects that are hit with that vuln.

Yeah it should be a learning experience, fix it and get over it. But it is not easy if you have 3 people waiting for you to slip to get your position. Some other want make money on writing a story about how bad your software is, even though it might be not your issue (VLC-bug story) because software is complicated. Good luck with explaining that was not your fault...

Meekro• 7 years ago

She then published the exploit publicly and they sued her

So you're saying that a bunch of volunteer open source developers collectively sued a security researcher? That sounds like it would have made for an epic Hacker News story. Do you have any documentation that this happened?

bifrost2• 7 years ago

Having dealt with some disclosure issues in the past, its fraught with peril.

There's even a conference dedicated to it now: https://www.disclosureconference.com/

Its probably worthwhile to attend.

shakna3• 7 years ago

So, the affected function, in includes/vb5/frontend/controller/bbcode.php was:

    function evalCode($code) {
        ob_start();
        eval($code);
        $output = ob_get_contents();
        ob_end_clean();
        return $output;
    }

... So anyone who looks at a codebase for eval would have found this. There is no doubt in my mind that when some people have claimed that this has been around for years... That it has definitely been around for years.

And as the fix is:

    // comment out. idk what it breaks but it's a fix for now
    //eval($code);

I don't think anyone even knows what the hell that eval was doing there in the first place.

techdevangelist• 7 years ago

vB has made heavy use of eval() for years, it’s used thru the bbcode parser, template and plugin features. I haven’t dug into the vB5 code base much, my heavy use ended in the 4 range. But this hasn’t been the first time it’s been exploited, and I suspect won’t be the last. When 5 was released we were already turned off to vB and it’s overall direction and settled on sticking with v4 until Xenforo matured more (the creators of which were original developers/architectes of vB 1,2,3.

wolfspider• 7 years ago

Oh yes brings back memories from when I worked on vBulletin customizations over a decade ago. No doubt it is a remnant of the early plugin features but also the hacks one had to employ with PHP before namespaces and a proper OOP structure was introduced. Eval in PHP was the go-to for sorting out versioning mishaps and adding a layer of abstraction when one didn’t exist. It was the Swiss Army knife of making difficult problems disappear so it makes sense to me that they had a specific method for this. Between versions 4 & 5 of PHP depending on whatever VHost was chosen eval was necessary sometimes just to start migrating over to version 5 because you could if...then...rewrite your eval(“new code”).

userbinator3• 7 years ago

For those interested, you can find the all-important path to that eval in the discussion here: https://www.reddit.com/r/netsec/comments/d8q2dt/vbulletin_0d...

It's not a straightforward POST -> eval but goes through a few calls, which is probably why it wasn't discovered sooner.

CalRobert• 7 years ago

About 9 years ago I was working in ad operations for the owners of vBulletin (they were a large internet publisher). I had just read a basic book on Java to use the Dart API to automate a bunch of tasks with the remnant waterfall. I'd been at "hello world" a few months prior. I had never used PHP aside from installing Wordpress.

When I gave notice, I was asked if I'd like to work on vBulletin as an engineer.

(Some good reading at https://vbtruth.com/category/company/vbulletin/ )

swiley• 7 years ago

Man why would anyone install code like that.

It’s script you can just read it guys, everyone fights so hard for open source and no one bothers reading anything.

koheripbal• 7 years ago

I once took over a Wordpress site and the prior dev told me that he just torrented the plugins.

It took me all of 15 minutes to find code injections appended to the bottom of the code files.

...but that wasn't the interesting part. Since it was a very popular SEO plugin, I actually took the extra time and reported the attack code wordpress security scanners and the torrent site.

A month later I checked back and the plugin had been re-uploaded, but this time with the attack code heavily obfuscated and much more subtely hidden within the plugin.

...and this time when I reported it to the torrent site, the site admins banned me and actually IP blocked me.

tldr; The only open source code getting reviewed is heavily used stuff.

ahje• 7 years ago

WordPress has commercial closed-source plug-ins available and one of the more popular ones happen to be a certain SEO-plug-in. You're certain it wasn't a pirated copy of a closed-source plugin?

Pirated closed-source themes and plug-ins for WordPress is a very common source of malware on WP sites.

ukyrgf2• 7 years ago

Wordpress is open source, but the plugins that people "null" and upload to a directory with write access usually aren't.

693471• 7 years ago

vBulletin is probably hundreds of thousands of lines of code. Nobody has time to "read the code" before installing it.

jcims• 7 years ago

vBulletin is closed source commercial software, isn't it?

userbinator3• 7 years ago

It's PHP, so you get the source if you're a paying customer (or find a warez'd copy), but I suspect the number of people looking through the source for vulnerabilities and not intending to keep their discoveries private is relatively low.

itcrowd2• 7 years ago

On an unrelated note, does anyone else get the feeling that the vBulletin website looks similar to what a Microsoft Support scammer might refer you to in order to download Remote Desktop software?

https://www.vbulletin.com/

hombre_fatal• 7 years ago

It all went to shit after the Internet Brands buyout.

They used to just dogfood their own software as their homepage: https://web.archive.org/web/20070205162247/http://www.vbulle...

cjbprime2• 7 years ago

Honest question: is there any coordinated responder effort to use RCE vulns like this one to patch the vuln and secure affected systems? Not asking just about this exploit in particular but about the entire world of 0day Internet RCE.

yjftsjthsd-h• 7 years ago

I doubt there's any coordinated effort because of legal issues if nothing else, but there have absolutely been various people doing that over the years. Off the top my head it's more popular with routers/IoT, where there have been people exploiting vulnerabilities in the name of both fixing them and just bricking the devices so that there are few are vulnerable devices on the internet.

michaelt• 7 years ago

There exist 'Anti-worms' like Anii-Santy and Welchia [1] which patch vulnerable hosts. And I've heard of malicious viruses that patch their host simply to ensure they have that host to themselves.

However, this is unambiguously illegal under anti-hacking laws like CFAA [2] which introduces a variety of practical difficulties.

[1] https://en.wikipedia.org/wiki/Anti-worm [2] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

cjbprime2• 7 years ago

Thanks. I wonder if doing it under the control of a team like CERT could make it less illegal. Or, if there was a way for a company to publicly pre-authorize a non-prosecution agreement for 0day patch defense. Surprised I haven't seen more discussion about the idea.

Uptrenda• 7 years ago

No offense intended, but I really don't know how it's possible to write a forum with so many vulnerabilities. Forums aren't exactly rocket science. It's basic input validation and you're good to go. Many recent functions (in PHP) already sanitize input even if you forget. So things like parametrized SQL queries and browser same origin policies really help limit the attack surface.

I find it depressing that vBulletin has been getting hacked for so long that it's literally outlived several of the major vulnerability disclosure websites that have historically published exploits about it (like milw0rm -- still an amazing theme, btw.) Maybe PHP should throw warnings about eval and recommend an alternative function purely for expressions instead. In Python apparently eval evaluates expressions for a result and exec would do what PHP's eval would do instead. Something like that for PHP would be better than nothing.

userbinator3• 7 years ago

No offense intended, but I really don't know how it's possible to write a forum with so many vulnerabilities. Forums aren't exactly rocket science. It's basic input validation and you're good to go.

You are definitely very correct about that, for a simple forum with basically no extensibility. Bugs arise from the fact that vB is extremely customisable and has lots of points for extension, making its codebase very complex.

zone411• 7 years ago

I don't know where you got this idea - full featured forums are very complicated compared to what most sites do.

reaperducer• 7 years ago

Every piece of software is simple and easy when someone else has to write it.

Unnamed Goose Game? It's just a bunch of polygons and MIDI riffs. No big whoop.

Slack? It's just a chat agent. Just some input validation and syndication. Easy peasy.

Microsoft Windows? It's just a window manager running on DOS. No sweat, I could whip that up over the weekend.

dsego• 7 years ago

If the codebase is anything like drupal or joomla, it doesn't surprise me. Those old school php systems are textbook examples of spaghetti code and big ball of mud patterns.

Sir_Cmpwn• 7 years ago

PHP is a public remote shell. Why is this in the news?

sascha_sl• 7 years ago

Ok thanks for your contribution.

Now where is my facebook dot com shell?

kevingadd• 7 years ago

Facebook hasn't been running stock PHP for years. They wrote their own compiler

commoner• 7 years ago

Any recommendations for forum software, preferably open source?

I'm aware of Discourse and Flarum, which use more modern designs:

https://www.discourse.org

https://flarum.org

phpBB and Simple Machines Forum both use classic designs similar to vBulletin:

https://www.phpbb.com

https://simplemachines.org

What's the best alternative to vBulletin?

winger• 7 years ago

As they are vary in different criteria, the best alternative is roll our own forum using CSS Grid.

torgoguys• 7 years ago

It depends on your criteria, but if you're looking for a well-supported, vBulletin-ish forum (focus on being a forum first-and-foremost, similar visual style, similar extensibility system) then XenForo is a very good candidate. If I didn't have a lot of time invested in my vBulletin setup (customization), I would go with them. For now, vBulletin works for me.

ukyrgf2• 7 years ago

Ooh I hadn't heard of Flarum yet; I'm going to try that one out.

As a user, Discourse forums have always felt bloated and slow. As a developer, I was shocked when I went to their installation documentation and saw it required 1 GB of RAM and 10 GB of disk space.

KajMagnus• 7 years ago

Maybe Talkyard could be of interest — a bit like Discourse, but has HackerNews type threaded discussions and a basic Slack like chat: https://www.talkyard.io (I'm developing it).

There are some improvements over HN: https://www.talkyard.io/-32/how-hacker-news-can-be-improved-...

smolder• 7 years ago

It would be easy to use the exploit to patch unpatched sites, rogue whitehat style...

crb• 7 years ago

What does the string "2dmfrb28nu3c6s9j" represent?

High-severity vulnerability in vBulletin is being actively exploited

Related Stories