Full Report
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, as affected, but does not give a lower version
Analysis Summary
# Vulnerability: vBulletin Unauthenticated Remote Code Execution (RCE) via `eval()`
## CVE Details
- **CVE ID**: Not explicitly assigned in provided context (often associated with zero-day or recent public disclosures like those found via SSD Secure Disclosure).
- **CVSS Score**: 9.8 - 10.0 (Estimated Critical)
- **CWE**: CWE-94 (Improper Control of Generation of Code - 'Code Injection')
## Affected Systems
- **Products**: vBulletin Forum Software
- **Versions**:
- 6.2.1 and earlier
- 6.1.6 and earlier
- **Configurations**: Default installations using PHP's `eval()` function within reachable routing or template logic.
## Vulnerability Description
The vulnerability is a classic PHP code injection flaw. It arises because unauthenticated HTTP requests can reach a code path that utilizes the `eval()` function without sufficient sanitization. By crafting a specific request to a vulnerable endpoint, an attacker can inject arbitrary PHP code which is then executed by the underlying server. This bypasses all authentication mechanisms and grants the attacker the same permissions as the web server user.
## Exploitation
- **Status**: **PoC available.** Public exploit details were released on July 27.
- **Complexity**: Low
- **Attack Vector**: Network (Remote)
## Impact
- **Confidentiality**: High (Total access to database and server files)
- **Integrity**: High (Ability to modify forum content and system files)
- **Availability**: High (Ability to crash the server or delete data)
## Remediation
### Patches
- Users should immediately upgrade to the latest security releases provided by vBulletin (Check the official members' area for versions succeeding 6.2.1 and 6.1.6).
### Workarounds
- Restrict access to the forum via Web Application Firewall (WAF) rules that filter for suspicious PHP syntax in GET/POST requests.
- If patching is not immediately possible, consider placing the forum behind a VPN or IP whitelist for administrative access.
## Detection
- **Indicators of Compromise**:
- Unusual entries in web server access logs containing PHP syntax (e.g., `system()`, `passthru()`, `base64_decode()`) targeted at forum endpoints.
- Presence of unauthorized web shells (e.g., `.php` files) in the `/core/` or index directories.
- **Detection methods**:
- Use file integrity monitoring (FIM) to detect unauthorized changes to vBulletin core files.
- Monitor server processes for unexpected outgoing network connections or shell spawns (`sh`, `bash`) initiated by the web server user.
## References
- **SSD Secure Disclosure**: hxxps[://]ssd-disclosure[.]com/ssd-advisory-vbulletin-unauthenticated-remote-code-execution/
- **Vendor Advisory**: hxxps[://]forum[.]vbulletin[.]com/forum/vbulletin-announcements/vbulletin-announcements_aa/