vBulletin RCE flaw actively exploited for backdoors
A remote code execution vulnerability in vBulletin forum software (CVE-2019-16759) is being exploited to install backdoors, with a later patch-bypass flaw also under active attack.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2019-16759 as exploited in the wild.
IPA (Japan's Information-technology Promotion Agency) issued an advisory warning of a critical remote code execution vulnerability in vBulletin, a widely used forum-building software. Exploit code for the vulnerability, tracked as CVE-2019-16759, was publicly disclosed, and IPA observed attack traffic attempting to leverage the flaw to plant backdoors on vulnerable websites. Given the public availability of exploit code, IPA warned that damage could spread and urged administrators to apply vendor patches immediately.
In an August 2020 update, IPA reported that a further vulnerability was discovered which allows attackers to bypass the original mitigation for CVE-2019-16759. Exploit code for this bypass has also been published, and active exploitation attempts have been confirmed. The vendor released additional patches to address the bypass, and IPA again urged prompt patching, noting that patch availability and coverage varies by vBulletin version.
This advisory reflects a pattern common to widely deployed CMS/forum platforms: once exploit code for a critical RCE is public, opportunistic scanning and backdoor-planting follows quickly, and incomplete initial patches can leave a window for bypass exploitation. Organizations running vBulletin should verify they are on the latest patched version covering both the original vulnerability and its bypass.
Mentioned in this report
Detection guidance
Web Server Process Spawning Shell Consistent with vBulletin Webshell Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP-FPM process spawning a command shell, consistent with execution of a webshell dropped after successful vBulletin RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell Consistent with vBulletin Webshell Execution
id: ad03ff07-49db-5710-a409-f7b6b2de0152
status: experimental
description: Identifies a web server or PHP process (apache, nginx, httpd, php-fpm)
spawning a shell interpreter, a common post-exploitation pattern when a webshell
dropped via a vBulletin RCE (e.g. CVE-2019-16759) is used to execute commands.
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /whoami
- /id
- /wget
- /curl
condition: selection_parent and selection_child
falsepositives:
- Legitimate server-side scripts that call system utilities (e.g. cron helper scripts,
image processing pipelines invoked via PHP)
- Administrative tooling that shells out from web-triggered cron jobs
level: medium
tags:
- attack.t1505.003
- attack.persistence
author: Vorant
New PHP File Written Into vBulletin Web Root by Web Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a new .php file within a vBulletin installation directory by the web server or PHP process itself, indicating possible webshell drop following successful RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New PHP File Written Into vBulletin Web Root by Web Server Process
id: 9d464d67-572f-59d0-8867-996422adb72c
status: experimental
description: Detects the web server or PHP-FPM process writing a new .php file into
a vBulletin core/forum directory, a behaviour consistent with dropping a webshell
backdoor after exploiting CVE-2019-16759 or its patch-bypass variant.
logsource:
category: file_event
product: linux
detection:
selection:
Image|endswith:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
TargetFilename|endswith: .php
TargetFilename|contains:
- /core/
- /forum/
- /includes/
filter:
TargetFilename|contains:
- /vendor/
- /cache/
condition: selection and not filter
falsepositives:
- Legitimate vBulletin plugin installation or upgrade activity performed through the
admin panel that writes new PHP files
- Automated deployment scripts updating vBulletin core files
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190927.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs