vBulletin forum software contains critical remote code execution vulnerabilities…

26 September 2019 critical vulnerability

vBulletin forum software contains critical remote code execution vulnerabilities (CVE-2019-16759 and bypass variants) actively exploited to deploy backdoors; immediate patching required.

IPA Japan has issued an alert regarding critical remote code execution vulnerabilities in vBulletin, a widely-used forum software platform. The initial vulnerability (CVE-2019-16759) allows remote attackers to execute arbitrary code on affected systems. Attack traffic attempting to exploit this vulnerability to install backdoors on websites has been observed in the wild, and public exploit code is available. In an August 2020 update, IPA confirmed that additional vulnerabilities have been discovered that bypass the patches for CVE-2019-16759. These bypass vulnerabilities are also being actively exploited, with public exploit code available. The vendor has released updated patches to address both the original vulnerability and the bypass techniques. Given the active exploitation, availability of weaponized exploits, and the potential for widespread impact on forum websites, organizations running vBulletin must apply the latest vendor patches immediately to prevent compromise.

Mentioned in this report

Vulnerabilities CVE-2019-16759KEV

Detection guidance

Web Server Process Spawning Shell After Possible vBulletin Exploit

ATT&CK T1190

Detects a web server or PHP-FPM/CGI process spawning a command interpreter or shell, consistent with successful RCE exploitation of vBulletin (CVE-2019-16759 and its patch-bypass variants). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell Interpreter
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /php-cgi
  shell_child:
    Image|endswith:
    - /bash
    - /sh
    - /dash
    - /perl
    - /python
    - /python3
    - /curl
    - /wget
    - /nc
    - /ncat
  condition: selection and shell_child
falsepositives:
- Legitimate CGI scripts or admin cron jobs that shell out from a web server worker
  process
- Health check or monitoring scripts executed via a web-triggered PHP script
level: high
tags:
- attack.t1190
- attack.t1505.003
id: a57c1c5f-f366-5103-ad23-b804e10f2f7f
author: Vorant

HTTP Request Targeting vBulletin Widget RCE Parameters

ATT&CK T1190

Detects HTTP requests containing the vBulletin ajax/render/widget_php routestring and widgetConfig[code] parameter combination used to exploit CVE-2019-16759 and its patch-bypass variants for remote code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious vBulletin Widget RCE Request Pattern
status: experimental
logsource:
  category: proxy
  product: null
detection:
  selection:
    cs-uri-query|contains:
    - routestring=ajax/render/widget_php
    - widgetConfig[code]
    - widgetConfig%5Bcode%5D
  condition: selection
falsepositives:
- Security scanners or penetration testers legitimately probing for the vulnerability
- Automated vulnerability assessment tools run by the organization itself
level: high
tags:
- attack.t1190
id: 65d0d36b-e779-5647-9a7b-036b908d3b7d
author: Vorant

New PHP File Written Into vBulletin Core Directories by Web Process

ATT&CK T1505.003

Detects creation of new PHP files within vBulletin core/includes directories by the web server process user, indicative of a web shell dropped after successful exploitation of vBulletin RCE vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP File Creation in vBulletin Includes Directory
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
    - /core/includes/
    - /includes/vb/
    - /includes/vb5/
    TargetFilename|endswith: .php
  condition: selection
falsepositives:
- Legitimate vBulletin plugin or template installation performed by an administrator
- Official vendor patch or upgrade process writing new PHP files into the same directories
level: medium
tags:
- attack.t1505.003
- attack.t1190
id: 8c447167-466e-5379-9a38-e3a0171a40da
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190927.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free