Ubuthathaka obungalungiswanga kwi-injini yokudala iiforum zewebhu vBulletin (yongeziweyo)

Ityhiliwe ulwazi malunga nokungalungiswanga (0-imini) ubungozi obubalulekileyo (CVE-2019-16759) kwi-injini yobunini bokwenza iiforum zewebhu vBulletin, ekuvumela ukuba wenze ikhowudi kumncedisi ngokuthumela isicelo esenziwe ngokukodwa se-POST. I-exploit esebenzayo ikhona kwingxaki. I-vBulletin isetyenziswa ziiprojekthi ezininzi ezivulekileyo, kubandakanya iiforamu ezisekelwe kule injini. Ubuntu, Vula, Iinkqubo zeBSD и Slackware.

Ukuba sesichengeni kukho kwi “ajax/render/widget_php” isibambi, esivumela ikhowudi yeqokobhe engavumelekanga ukuba igqithwe kwi “widgetConfig[code]” iparameter (ikhowudi yokuphehlelelwa igqithiswa ngokulula, awufuni nokubaleka nantoni na) . Uhlaselo alufuni ukuqinisekiswa kweforamu. Ingxaki iqinisekisiwe kuzo zonke izikhupho ze-vBulletin 5.x yesebe yangoku (eyaphuhliswa ukususela ngo-2012), kubandakanywa nokukhululwa kwangoku 5.5.4. Uhlaziyo olunokulungiswa akukalungiswa.

Ukongeza 1: Kwiinguqulelo 5.5.2, 5.5.3 kunye 5.5.4 ikhutshiwe amabala. Abanini bokukhutshwa kwe-5.x endala bayacetyiswa ukuba baqale bahlaziye iinkqubo zabo kwiinguqulelo zamva nje ezixhaswayo ukuphelisa ubuthathaka, kodwa njengendlela yokusebenza. unako phawula phandle ukubiza "eval($code)" kwikhowudi yokusebenza kwe-evalCode kwifayile ibandakanya/vb5/frontend/controller/bbcode.php.

IsiHlomelo 2: Ubuthathaka sele busebenza iyasebenza kuhlaselo, ukuthunyelwa kwe-spam и ukushiya ngasemva. Umkhondo wohlaselo unokubonwa kwiilogi zeseva ye-http ngobukho bezicelo zomgca "ajax/render/widget_php".

IsiHlomelo 3: phezulu umkhondo wokusetyenziswa kwengxaki ekuxoxwa ngayo kuhlaselo oludala; ngokucacileyo, ubuthathaka sele busetyenziswe malunga neminyaka emithathu. Ngaphandle koko, ipapashiwe iskripthi esingasetyenziselwa ukwenza uhlaselo oluzenzekelayo olufuna ukukhangela iinkqubo ezisengozini ngenkonzo yeShodan.

umthombo: opennet.ru