vBulletin released patches for an undisclosed security vulnerability, encouraging users to apply the patch as soon as possible.
Background
On May 7, vBulletin, a popular online forum software, announced a patch for a security vulnerability in its software. While details have not yet been disclosed, vBulletin said it is “imperative” that users of their software patch the vulnerability as soon as possible. Based on what we've seen from previous vBulletin vulnerabilities, we anticipate attackers will attempt to attack vulnerable sites as soon as details become available.
Analysis
CVE-2020-12720 is an access control related issue in the vBulletin software. Full details about the flaw are not yet public. However, Charles Fol, a security engineer at Ambionics who reported the vulnerability, has tweeted that CVE-2020-12720 is “critical” and that users should patch their software. Fol plans to provide further information about the flaw during the SSTIC conference from June 3-5.
vBulletin released a patch addressing a critical vulnerability I reported through @ambionics. Patch your software. Details will be released during @sstic.
— Charles Fol (@cfreal_) May 8, 2020
vBulletin sites were attacked in less than 24 hours after CVE-2019-16759, a remote code execution flaw, was anonymously disclosed via the SecLists.org security mailing list in September 2019. Therefore, it’s reasonable to assume that attackers will attempt to reverse engineer the patch and craft exploit code based on what the security patches change in vBulletin’s code.
Proof of concept
At the time this blog was published, no proof-of-concept (PoC) code was available for this vulnerability. We expect more information, including a PoC, may become available following Fol’s talk at SSTIC in early June.
Solution
Users can download respective patches for the following versions in the Member’s Area of the vBulletin forums:
- 5.6.1 Patch Level 1
- 5.6.0 Patch Level 1
- 5.5.6 Patch Level 1
Users of vBulletin Cloud sites have already had the patch applied and do not need to take any action.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.