Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

CVE-2020-12720: vBulletin Urges Users to Patch Undisclosed Security Vulnerability

vBulletin released patches for an undisclosed security vulnerability, encouraging users to apply the patch as soon as possible.

Update 05/12/20: Updated the Analysis and Proof of concept section to reflect the availability of PoCs from a vulnerability researcher.

Background

On May 7, vBulletin, a popular online forum software, announced a patch for a security vulnerability in its software. While details have not yet been disclosed, vBulletin said it is “imperative” that users of their software patch the vulnerability as soon as possible. Based on what we've seen from previous vBulletin vulnerabilities, we anticipate attackers will attempt to attack vulnerable sites as soon as details become available.

Analysis

CVE-2020-12720 is an access control related issue in the vBulletin software. Full details about the flaw are not yet public. However, Charles Fol, a security engineer at Ambionics who reported the vulnerability, has tweeted that CVE-2020-12720 is “critical” and that users should patch their software. Fol plans to provide further information about the flaw during the SSTIC conference from June 3-5.

vBulletin sites were attacked in less than 24 hours after CVE-2019-16759, a remote code execution flaw, was anonymously disclosed via the SecLists.org security mailing list in September 2019. Therefore, it’s reasonable to assume that attackers will attempt to reverse engineer the patch and craft exploit code based on what the security patches change in vBulletin’s code.

Patch diffing reveals vulnerability details

On May 8, vulnerability researcher Amir Etemadieh tweeted that he was diffing the changes in vBulletin version 5.6.1 vs. 5.6.1 PL1. In his initial analysis, Etemadieh said that while hunting for incorrect access control flaws, he was only able to identify SQL injection flaws instead.

On May 12, Etemadieh posted a Twitter thread containing PoCs for unauthenticated SQL injection flaws to obtain the admin user as well as the admin user’s security token from a vulnerable vBulletin instance.

Etemadieh plans to provide further information in a write-up, optimizing his exploit while digging further into the patch differences.

Proof of concept

At the time this blog was published, no proof-of-concept (PoC) code was available for this vulnerability. On May 12, vulnerability researcher Amir Etemadieh publicly shared PoCs for unauthenticated SQL injection against a vulnerable vBulletin instance. We still expect more information to become available following Fol’s talk at SSTIC in early June.

Solution

Users can download respective patches for the following versions in the Member’s Area of the vBulletin forums:

  • 5.6.1 Patch Level 1
  • 5.6.0 Patch Level 1
  • 5.5.6 Patch Level 1

Users of vBulletin Cloud sites have already had the patch applied and do not need to take any action.

Identifying affected systems

A list of Tenable plugins to identify this vulnerability will appear here as they’re released.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.