CVE-2020-12720: vBulletin Urges Users to Patch Undisclosed Security Vulnerability
vBulletin released patches for an undisclosed security vulnerability, encouraging users to apply the patch as soon as possible.
Update 05/12/20: Updated the Analysis and Proof of concept section to reflect the availability of PoCs from a vulnerability researcher.
Background
On May 7, vBulletin, a popular online forum software, announced a patch for a security vulnerability in its software. While details have not yet been disclosed, vBulletin said it is “imperative” that users of their software patch the vulnerability as soon as possible. Based on what we've seen from previous vBulletin vulnerabilities, we anticipate attackers will attempt to attack vulnerable sites as soon as details become available.
Analysis
CVE-2020-12720 is an access control related issue in the vBulletin software. Full details about the flaw are not yet public. However, Charles Fol, a security engineer at Ambionics who reported the vulnerability, has tweeted that CVE-2020-12720 is “critical” and that users should patch their software. Fol plans to provide further information about the flaw during the SSTIC conference from June 3-5.
vBulletin released a patch addressing a critical vulnerability I reported through @ambionics. Patch your software. Details will be released during @sstic.
— Charles Fol (@cfreal_) May 8, 2020
vBulletin sites were attacked in less than 24 hours after CVE-2019-16759, a remote code execution flaw, was anonymously disclosed via the SecLists.org security mailing list in September 2019. Therefore, it’s reasonable to assume that attackers will attempt to reverse engineer the patch and craft exploit code based on what the security patches change in vBulletin’s code.
Patch diffing reveals vulnerability details
On May 8, vulnerability researcher Amir Etemadieh tweeted that he was diffing the changes in vBulletin version 5.6.1 vs. 5.6.1 PL1. In his initial analysis, Etemadieh said that while hunting for incorrect access control flaws, he was only able to identify SQL injection flaws instead.
I'm diffing the changes for CVE-2020-12720 in vBulletin 5.6.1 vs 5.6.1 PL1 and while the CVE is marked as an "incorrect access control" vulnerability all I currently see is 2 fixes for SQLi vulns. 1/5https://t.co/DTz6KG8tky
— Amir Etemadieh (@Zenofex) May 9, 2020
On May 12, Etemadieh posted a Twitter thread containing PoCs for unauthenticated SQL injection flaws to obtain the admin user as well as the admin user’s security token from a vulnerable vBulletin instance.
Looks like vB was actually patching a SQL injection vuln with the latest round of patches in vBulletin 5.6.1. Here's an unauthenticated SQLi PoC
— Amir Etemadieh (@Zenofex) May 12, 2020
curl "http://localhost/vb5/ajax/api/content_attach/getIndexableContent" -H 'X-Requested-With: XMLHttpRequest' -d "nodeId[nodeid]=SQLi"
Etemadieh plans to provide further information in a write-up, optimizing his exploit while digging further into the patch differences.
Proof of concept
At the time this blog was published, no proof-of-concept (PoC) code was available for this vulnerability. On May 12, vulnerability researcher Amir Etemadieh publicly shared PoCs for unauthenticated SQL injection against a vulnerable vBulletin instance. We still expect more information to become available following Fol’s talk at SSTIC in early June.
Solution
Users can download respective patches for the following versions in the Member’s Area of the vBulletin forums:
- 5.6.1 Patch Level 1
- 5.6.0 Patch Level 1
- 5.5.6 Patch Level 1
Users of vBulletin Cloud sites have already had the patch applied and do not need to take any action.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Cybersecurity Snapshot: U.S. Gov’t Unpacks AI Threat to Banks, as NCSC Urges OT Teams to Protect Cloud SCADA Systems
March 29, 2024Check out new guidance for banks on combating AI-boosted fraud. Plus, how to cut cyber risk when migrating SCADA systems to the cloud. Meanwhile, why CISA is fed up with SQLi flaws. And best practices to prevent and respond to DDoS attacks. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
Oracle April 2024 Critical Patch Update Addresses 239 CVEs
April 17, 2024Oracle addresses 239 CVEs in its second quarterly update of 2024 with 441 patches, including 38 critical updates.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
- Vulnerability Management