MyBB 1.8.6 Account Activation Reflected cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in MyBB 1.8.6. This impacts an unknown function of the component Account Activation Handler. The manipulation results in cross site scripting (Reflected). The attack may be launched remotely. Furthermore, there is an exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in MyBB 1.8.6 (Content Management System). Affected is some unknown functionality of the component Account Activation Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability (Reflected). CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on integrity.

The weakness was shared 11/10/2016 by Tim Coen with Curesec Research Team as MyBB 1.8.6: XSS as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The vendor cooperated in the coordination of the public release. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007. The advisory points out:

In many of the update scripts, POST values are echoed without proper encoding. The scripts are upgrade3.php, upgrade12.php, upgrade13.php, upgrade17.php, and upgrade30.php. As this attack only works when the forum is disabled, the forum itself cannot be attacked, but the attack could be used to attack other software hosted on the same domain.

A public exploit has been developed by Tim Coen and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 279 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 1.8.7 eliminates this vulnerability. The upgrade is hosted for download at resources.mybb.com. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The entries VDB-93560, VDB-93561, VDB-93562 and VDB-93563 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• MyBB

Version

• 1.8.6

License

• open-source

Website

• Product: https://mybb.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion