MyBB 1.8.6 Error Reflected cross site scripting

Summaryinfo

A vulnerability has been found in MyBB 1.8.6 and classified as problematic. Affected is an unknown function of the component Error Handler. This manipulation causes cross site scripting (Reflected). Remote exploitation of the attack is possible. Furthermore, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in MyBB 1.8.6 (Content Management System). Affected by this vulnerability is an unknown part of the component Error Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability (Reflected). The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity.

The weakness was published 11/10/2016 by Tim Coen with Curesec Research Team as MyBB 1.8.6: XSS as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The public release has been coordinated with the project team. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue. The advisory points out:

When displaying an error, MyBB echoes user input in a style context, allowing an attacker to inject CSS. With this, it may be possible to change the look of the website or extract information, and it may lead to XSS in older browsers.

A public exploit has been developed by Tim Coen and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 279 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 1.8.7 eliminates this vulnerability. The upgrade is hosted for download at resources.mybb.com. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Similar entries are available at VDB-93560, VDB-93561, VDB-93562 and VDB-93563. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Name

• MyBB

Version

• 1.8.6

License

• open-source

Website

• Product: https://mybb.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion