CVE-2020-12720: vBulletin Urges Users to Patch Undisclosed Security Vulnerability
vBulletin released patches for an undisclosed security vulnerability, encouraging users to apply the patch as soon as possible.
Update 05/12/20: Updated the Analysis and Proof of concept section to reflect the availability of PoCs from a vulnerability researcher.
Background
On May 7, vBulletin, a popular online forum software, announced a patch for a security vulnerability in its software. While details have not yet been disclosed, vBulletin said it is “imperative” that users of their software patch the vulnerability as soon as possible. Based on what we've seen from previous vBulletin vulnerabilities, we anticipate attackers will attempt to attack vulnerable sites as soon as details become available.
Analysis
CVE-2020-12720 is an access control related issue in the vBulletin software. Full details about the flaw are not yet public. However, Charles Fol, a security engineer at Ambionics who reported the vulnerability, has tweeted that CVE-2020-12720 is “critical” and that users should patch their software. Fol plans to provide further information about the flaw during the SSTIC conference from June 3-5.
vBulletin released a patch addressing a critical vulnerability I reported through @ambionics. Patch your software. Details will be released during @sstic.
— Charles Fol (@cfreal_) May 8, 2020
vBulletin sites were attacked in less than 24 hours after CVE-2019-16759, a remote code execution flaw, was anonymously disclosed via the SecLists.org security mailing list in September 2019. Therefore, it’s reasonable to assume that attackers will attempt to reverse engineer the patch and craft exploit code based on what the security patches change in vBulletin’s code.
Patch diffing reveals vulnerability details
On May 8, vulnerability researcher Amir Etemadieh tweeted that he was diffing the changes in vBulletin version 5.6.1 vs. 5.6.1 PL1. In his initial analysis, Etemadieh said that while hunting for incorrect access control flaws, he was only able to identify SQL injection flaws instead.
I'm diffing the changes for CVE-2020-12720 in vBulletin 5.6.1 vs 5.6.1 PL1 and while the CVE is marked as an "incorrect access control" vulnerability all I currently see is 2 fixes for SQLi vulns. 1/5https://t.co/DTz6KG8tky
— Amir Etemadieh (@Zenofex) May 9, 2020
On May 12, Etemadieh posted a Twitter thread containing PoCs for unauthenticated SQL injection flaws to obtain the admin user as well as the admin user’s security token from a vulnerable vBulletin instance.
Looks like vB was actually patching a SQL injection vuln with the latest round of patches in vBulletin 5.6.1. Here's an unauthenticated SQLi PoC
— Amir Etemadieh (@Zenofex) May 12, 2020
curl "http://localhost/vb5/ajax/api/content_attach/getIndexableContent" -H 'X-Requested-With: XMLHttpRequest' -d "nodeId[nodeid]=SQLi"
Etemadieh plans to provide further information in a write-up, optimizing his exploit while digging further into the patch differences.
Proof of concept
At the time this blog was published, no proof-of-concept (PoC) code was available for this vulnerability. On May 12, vulnerability researcher Amir Etemadieh publicly shared PoCs for unauthenticated SQL injection against a vulnerable vBulletin instance. We still expect more information to become available following Fol’s talk at SSTIC in early June.
Solution
Users can download respective patches for the following versions in the Member’s Area of the vBulletin forums:
- 5.6.1 Patch Level 1
- 5.6.0 Patch Level 1
- 5.5.6 Patch Level 1
Users of vBulletin Cloud sites have already had the patch applied and do not need to take any action.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
CVE-2024-47575: Frequently Asked Questions About FortiJump Zero-Day in FortiManager and FortiManager Cloud
October 23, 2024Frequently asked questions about a zero-day vulnerability in Fortinet’s FortiManager that has reportedly been exploited in the wild.
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
October 22, 2024Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.
Oracle October 2024 Critical Patch Update Addresses 198 CVEs
October 15, 2024Oracle addresses 198 CVEs in its fourth quarterly update of 2024 with 334 patches, including 35 critical updates.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
Cybersecurity Snapshot: New Guides Offer Best Practices for Preventing Shadow AI and for Deploying Secure Software Updates
October 25, 2024Looking for help with shadow AI? Want to boost your software updates’ safety? New publications offer valuable tips. Plus, learn why GenAI and data security have become top drivers of cyber strategies. And get the latest on the top “no-nos” for software security; the EU’s new cyber law; and CISOs’ communications with boards.
- Vulnerability Management