Within three days of disclosure, the vendors deployed a fix for the flaw.
However, recently, another security researcher Amir Etemadieh discovered that the fix had a security issue and could find a way to bypass the patch and exploit the flaw. He even shared the PoCs for it in Bash, Python, and Ruby.
https://twitter.com/Zenofex/status/1292587626067828736
- Zenofex
Sharing the details in a blog post, the researcher revealed that the problems existed in the vBulletin template structure. As stated,
Specifically, templates aren’t actually written in PHP but instead are written in a language that is first processed by the template engine and then is output as a string of PHP code that is later ran through an eval() during the “rendering” process.Furthermore, the templates could have numerous child templates after being nested. This structure triggered numerous security bugs. A bug in one template could expose other code too, including the parent template.
Thus, the researcher could bypass the fix by exploiting the template “widget_tabbedcontainer_tab_panel” that had two features.
1. The templates ability to load a user controlled child template. 2. The template loads the child template by taking a value from a separately named value and placing it into a variable named “widgetConfig”.He has also shared a detailed presentation for anyone to test the exploit.
Shortly after the disclosure, attackers exploited the vulnerability to hack the DEFCON forum.
https://twitter.com/thedarktangent/status/1292813958332596224
- thedarktangent
vBulletin has recently released a fix for this flaw as well. As announced, they have fixed the bug with the release of vBulletin Connect versions 5.6.2, 5.6.1, and 5.6.0. Whereas, it did not affect vBulletin Cloud sites.
Let us know your thoughts in the comments.
