CRITICAL

CVE-2020-17496

Vbulletin Vbulletin 2020-08-12 CVSS v3.1

CVSS

9.8

KEV

Description

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

Summary dbcve.org

vBulletin 5.5.4 through 5.6.2 contains a remote command execution vulnerability in the widget rendering system. Attackers can execute arbitrary OS commands by sending crafted subWidgets data through the ajax/render/widget_tabbedcontainer_tab_panel AJAX endpoint. This flaw exists because the previous fix for CVE-2019-16759 was incomplete, leaving a path for command injection.

Mitigation

Immediately upgrade vBulletin to the latest patched version to remediate this critical RCE. If immediate patching is not possible, consider restricting access to the affected AJAX endpoint at the web server level or disabling the widget system temporarily.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-74 Injection

EPSS Score

87.74%

Probability of exploitation in next 30 days

99.8th percentile

References

https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ Exploit, Third Party Advisory https://cwe.mitre.org/data/definitions/78.html Technical Description https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch Patch, Vendor Advisory https://seclists.org/fulldisclosure/2020/Aug/5 Exploit, Mailing List, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17496 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE