vBulletin patches critical remote code execution vulnerabilities
vBulletin forum software contains critical remote code execution vulnerabilities (CVE-2019-16759 and bypass variants) actively exploited to deploy backdoors; immediate patching required.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2019-16759 as exploited in the wild.
IPA Japan has issued an alert regarding critical remote code execution vulnerabilities in vBulletin, a widely-used forum software platform. The initial vulnerability (CVE-2019-16759) allows remote attackers to execute arbitrary code on affected systems. Attack traffic attempting to exploit this vulnerability to install backdoors on websites has been observed in the wild, and public exploit code is available. In an August 2020 update, IPA confirmed that additional vulnerabilities have been discovered that bypass the patches for CVE-2019-16759. These bypass vulnerabilities are also being actively exploited, with public exploit code available. The vendor has released updated patches to address both the original vulnerability and the bypass techniques. Given the active exploitation, availability of weaponized exploits, and the potential for widespread impact on forum websites, organizations running vBulletin must apply the latest vendor patches immediately to prevent compromise.
Mentioned in this report
Detection guidance
Web Server Process Spawning Shell After Possible vBulletin Exploit
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP-FPM/CGI process spawning a command interpreter or shell, consistent with successful RCE exploitation of vBulletin (CVE-2019-16759 and its patch-bypass variants). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell Interpreter
status: experimental
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- /httpd
- /apache2
- /nginx
- /php-fpm
- /php-cgi
shell_child:
Image|endswith:
- /bash
- /sh
- /dash
- /perl
- /python
- /python3
- /curl
- /wget
- /nc
- /ncat
condition: selection and shell_child
falsepositives:
- Legitimate CGI scripts or admin cron jobs that shell out from a web server worker
process
- Health check or monitoring scripts executed via a web-triggered PHP script
level: high
tags:
- attack.t1190
- attack.t1505.003
id: a57c1c5f-f366-5103-ad23-b804e10f2f7f
author: Vorant
New PHP File Written Into vBulletin Core Directories by Web Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of new PHP files within vBulletin core/includes directories by the web server process user, indicative of a web shell dropped after successful exploitation of vBulletin RCE vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Creation in vBulletin Includes Directory
status: experimental
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- /core/includes/
- /includes/vb/
- /includes/vb5/
TargetFilename|endswith: .php
condition: selection
falsepositives:
- Legitimate vBulletin plugin or template installation performed by an administrator
- Official vendor patch or upgrade process writing new PHP files into the same directories
level: medium
tags:
- attack.t1505.003
- attack.t1190
id: 8c447167-466e-5379-9a38-e3a0171a40da
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20190927.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs