VORANT. Threat Intelligence Sign in Get the full feed

vBulletin RCE flaw actively exploited for backdoors

high vulnerability

A remote code execution vulnerability in vBulletin forum software (CVE-2019-16759) is being exploited to install backdoors, with a later patch-bypass flaw also under active attack.

IPA (Japan's Information-technology Promotion Agency) issued an advisory warning of a critical remote code execution vulnerability in vBulletin, a widely used forum-building software. Exploit code for the vulnerability, tracked as CVE-2019-16759, was publicly disclosed, and IPA observed attack traffic attempting to leverage the flaw to plant backdoors on vulnerable websites. Given the public availability of exploit code, IPA warned that damage could spread and urged administrators to apply vendor patches immediately.

In an August 2020 update, IPA reported that a further vulnerability was discovered which allows attackers to bypass the original mitigation for CVE-2019-16759. Exploit code for this bypass has also been published, and active exploitation attempts have been confirmed. The vendor released additional patches to address the bypass, and IPA again urged prompt patching, noting that patch availability and coverage varies by vBulletin version.

This advisory reflects a pattern common to widely deployed CMS/forum platforms: once exploit code for a critical RCE is public, opportunistic scanning and backdoor-planting follows quickly, and incomplete initial patches can leave a window for bypass exploitation. Organizations running vBulletin should verify they are on the latest patched version covering both the original vulnerability and its bypass.

Mentioned in this report

Vulnerabilities CVE-2019-16759KEV

Detection guidance

Possible vBulletin CVE-2019-16759 Exploitation Attempt via widgetConfig Parameter

ATT&CK T1190

Detects HTTP requests to vBulletin's ajax render endpoint containing the routestring/widgetConfig parameters used to trigger the CVE-2019-16759 pre-auth RCE (and its 2020 patch-bypass variant). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Possible vBulletin CVE-2019-16759 Exploitation Attempt via widgetConfig Parameter
id: 08eaf01b-4ae9-5301-89ff-5ef80e12ea4f
status: experimental
description: Detects HTTP requests targeting vBulletin's ajax/render/widget_php endpoint
  with a routestring parameter referencing widgetConfig, the pattern used to exploit
  CVE-2019-16759 and its subsequent patch-bypass vulnerability to achieve remote code
  execution.
references:
- https://www.ipa.go.jp/security/ (vBulletin RCE advisory)
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    c-uri|contains:
    - ajax/render/widget_php
  selection_param:
    c-uri|contains:
    - routestring=widget_php
    - widgetConfig
  condition: selection and selection_param
falsepositives:
- Legitimate widget rendering requests are rare in normal user traffic but automated
  security scanners/pentests may generate similar patterns
level: high
tags:
- attack.t1190
- attack.initial_access
- cve.2019-16759
author: Vorant

Web Server Process Spawning Shell Consistent with vBulletin Webshell Execution

ATT&CK T1505.003

Detects a web server or PHP-FPM process spawning a command shell, consistent with execution of a webshell dropped after successful vBulletin RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell Consistent with vBulletin Webshell Execution
id: ad03ff07-49db-5710-a409-f7b6b2de0152
status: experimental
description: Identifies a web server or PHP process (apache, nginx, httpd, php-fpm)
  spawning a shell interpreter, a common post-exploitation pattern when a webshell
  dropped via a vBulletin RCE (e.g. CVE-2019-16759) is used to execute commands.
references:
- https://www.ipa.go.jp/security/ (vBulletin RCE advisory)
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /whoami
    - /id
    - /wget
    - /curl
  condition: selection_parent and selection_child
falsepositives:
- Legitimate server-side scripts that call system utilities (e.g. cron helper scripts,
  image processing pipelines invoked via PHP)
- Administrative tooling that shells out from web-triggered cron jobs
level: medium
tags:
- attack.t1505.003
- attack.persistence
author: Vorant

New PHP File Written Into vBulletin Web Root by Web Server Process

ATT&CK T1505.003

Detects creation of a new .php file within a vBulletin installation directory by the web server or PHP process itself, indicating possible webshell drop following successful RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: New PHP File Written Into vBulletin Web Root by Web Server Process
id: 9d464d67-572f-59d0-8867-996422adb72c
status: experimental
description: Detects the web server or PHP-FPM process writing a new .php file into
  a vBulletin core/forum directory, a behaviour consistent with dropping a webshell
  backdoor after exploiting CVE-2019-16759 or its patch-bypass variant.
references:
- https://www.ipa.go.jp/security/ (vBulletin RCE advisory)
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    TargetFilename|endswith: .php
    TargetFilename|contains:
    - /core/
    - /forum/
    - /includes/
  filter:
    TargetFilename|contains:
    - /vendor/
    - /cache/
  condition: selection and not filter
falsepositives:
- Legitimate vBulletin plugin installation or upgrade activity performed through the
  admin panel that writes new PHP files
- Automated deployment scripts updating vBulletin core files
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190927.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free