Exploits in the Wild for vBulletin Pre-Auth RCE Vulnerability CVE-2020-17496
Summary: Unit 42 researchers found exploits in the wild for CVE-2020-17496, a pre-auth remote code execution flaw in vBulletin that bypasses the fix for CVE-2019-16759 by abusing the widget_tabbedcontainer_tab_panel template to load widget_php with malicious code. The first exploitation was caught on Aug. 10, 2020, the same day vBulletin released its patch, with ongoing scans from multiple source IPs attempting command execution, /etc/passwd reads, web shell installation, and Shellbot downloads from 178[.]170[.]117[.]50 that connect to an IRC C2 at 66[.]7[.]149[.]161:6667.
What's compelling: More than 100,000 sites run vBulletin, including forums of major enterprises and organizations, and the attacks observed are disparate scans rather than a coordinated effort - meaning the population probing for this flaw is broad and the window between disclosure and exploitation was effectively zero.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-16759CVE-2020-17496
- Related