vBulletin HTML Injection Vulnerability
BID:6337
Info
vBulletin HTML Injection Vulnerability
| Bugtraq ID: | 6337 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 09 2002 12:00AM |
| Updated: | Dec 09 2002 12:00AM |
| Credit: | Discovery of this vulnerability credited to "Dorin Balanica" <[email protected]>. |
| Vulnerable: |
VBulletin VBulletin 2.2.8 VBulletin VBulletin 2.2.7 |
| Not Vulnerable: | |
Discussion
vBulletin HTML Injection Vulnerability
Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages.
vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to view a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site hosting the vBulletin forum software.
Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.
This should only be considered an issue if HTML has been enabled in messages. This option is not enabled by default and the vendor recommends that users do not enable it. If the option has been enabled, HTML will not be filtered at all.
*** This vulnerability has been further investigated. It has been reported by the vendor that this functionality is by disabled by default. Additionally, the risks of enabling this feature are documented in the user manual. Therefore, this is not a valid vulnerability, and will be removed from the SecurityFocus Vulnerability Database.
Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages.
vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to view a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site hosting the vBulletin forum software.
Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.
This should only be considered an issue if HTML has been enabled in messages. This option is not enabled by default and the vendor recommends that users do not enable it. If the option has been enabled, HTML will not be filtered at all.
*** This vulnerability has been further investigated. It has been reported by the vendor that this functionality is by disabled by default. Additionally, the risks of enabling this feature are documented in the user manual. Therefore, this is not a valid vulnerability, and will be removed from the SecurityFocus Vulnerability Database.
Exploit / POC
vBulletin HTML Injection Vulnerability
The following proof of concept was provided:
<b onMouseOver="alert(document.location);">Test!</b>
The following proof of concept was provided:
<b onMouseOver="alert(document.location);">Test!</b>
Solution / Fix
vBulletin HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
vBulletin HTML Injection Vulnerability
References:
References:
- Vendor Homepage (Kyberna)
- Input Validation Error in vbulletin 2.2.x ("Dorin Balanica"