Vulnerabilities > CVE-2016-10073 - Information Exposure vulnerability in Vanillaforums Vanilla

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
vanillaforums
CWE-200
nessus
exploit available
metasploit
NVD
Published: 2017-05-23
Updated: 2019-07-11

Summary

The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.

Vulnerable Configurations

Part Description Count
Application
Vanillaforums
74

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Exploit-Db

descriptionVanilla Forums < 2.3 - Remote Code Execution. CVE-2016-10033,CVE-2016-10073. Remote exploit for PHP platform
fileexploits/php/remote/41996.sh
idEDB-ID:41996
last seen2017-05-12
modified2017-05-11
platformphp
port
published2017-05-11
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/41996/
titleVanilla Forums < 2.3 - Remote Code Execution
typeremote

Metasploit

descriptionChecks if the host is vulnerable to Host header injection
idMSF:AUXILIARY/SCANNER/HTTP/HOST_HEADER_INJECTION
last seen2020-03-11
modified2019-11-22
published2015-10-07
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/scanner/http/host_header_injection.rb
titleHTTP Host Header Injection Detection

Nessus

NASL familyCGI abuses
NASL idVANILLA_HOST_INJECTION.NASL
descriptionThe from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.
last seen2020-06-01
modified2020-06-02
plugin id104659
published2017-11-17
reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/104659
titleVanilla Forums Header Injection Remote Code Execution
code
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(104659);
  script_version("1.5");
  script_cvs_date("Date: 2019/11/12");

  script_cve_id("CVE-2016-10073");
  script_xref(name:"EDB-ID", value:"41996");

  script_name(english:"Vanilla Forums Header Injection Remote Code Execution");
  script_summary(english:"Checks Vanilla version from its homepage");

  script_set_attribute(attribute:"synopsis", value:
"Vanilla Forums contains a flaw that may allow a remote attacker to 
  obtain sensitive information via password reset request.");
  script_set_attribute(attribute:"description", value:
"The from method in library/core/class.email.php in Vanilla Forums 
before 2.3.1 allows remote attackers to spoof the email domain in sent
 messages and potentially obtain sensitive information via a crafted 
 HTTP Host header, as demonstrated by a password reset request.");
  # https://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fcce1c82");
  # https://legalhackers.com/advisories/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?879a187f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Vanilla 2.3.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-10073");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vanilla_forums_detect.nbin");
  script_require_keys("installed_sw/Vanilla Forums");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("http.inc");
include("vcf.inc");

appname = 'Vanilla Forums';

get_install_count(app_name:appname, exit_if_zero:TRUE);

port = get_http_port(default:80,php:TRUE);

app_info = vcf::get_app_info(app:appname, port:port, webapp:TRUE);

constraints = [
  { "min_version" : "1.0.0", "max_version" : "2.3.0", "fixed_version" : "2.3.1" }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/142486/vanillaforums-exec.txt
idPACKETSTORM:142486
last seen2017-05-13
published2017-05-12
reporterDawid Golunski
sourcehttps://packetstormsecurity.com/files/142486/Vanilla-Forums-2.3-Remote-Code-Execution.html
titleVanilla Forums 2.3 Remote Code Execution

Seebug

bulletinFamilyexploit
descriptionI. VULNERABILITY ------------------------- Vanilla Forums <= 2.3 Unauth. Remote Code Execution (RCE) exploit CVE-2016-10033 [0day] II. BACKGROUND ------------------------- "Community Forums Reinvented Create an online community that your customers will love. Vanilla's forum software is used by top brands to engage customers, drive loyalty and reduce support costs." "Vanilla provides cloud and open source community forum software that powers discussion forums worldwide with close to 1M downloads. Built for flexibility and integration, Vanilla is the best, most powerful community solution in the world." https://vanillaforums.com/en/software/ https://open.vanillaforums.com/ III. INTRODUCTION ------------------------- Vanilla Forums software (including the latest stable version of 2.3 in its default configuration) is affected by: ** Remote Code Execution CVE-2016-10033 (0day) ** which can be exploited by unauthenticated remote attackers to execute arbitrary code and fully compromise the target application when combined with Host Header injection vulnerability CVE-2016-10073 (described in a separate advisory). IV. DESCRIPTION ------------------------- As described in the advisory of CVE-2016-10073: The HOST header is used to form the sender email address as we can see in the following snippet of code: ``` ------[ library/core/class.email.php ]------ ... public function from($SenderEmail = '', $SenderName = '', $bOverrideSender = false) { if ($SenderEmail == '') { $SenderEmail = c('Garden.Email.SupportAddress', ''); if (!$SenderEmail) { $SenderEmail = 'noreply@'.Gdn::request()->host(); } } if ($SenderName == '') { $SenderName = c('Garden.Email.SupportName', c('Garden.Title', '')); } if ($this->PhpMailer->Sender == '' || $bOverrideSender) { $this->PhpMailer->Sender = $SenderEmail; } ob_start(); $this->PhpMailer->setFrom($SenderEmail, $SenderName, false); ob_end_clean(); return $this; } ``` In default configuration of Vanilla the address is then passed to the phpmailer library as the sender address in the line: ``` $this->PhpMailer->Sender = $SenderEmail; ``` The official stable version 2.3 available at: https://open.vanillaforums.com/addon/vanilla-core-2.3 is bundled with PHPMailer library in version 5.1: ``` -----[ library/vendors/phpmailer/class.phpmailer.php ]---- <?php /*~ class.phpmailer.php | Software: PHPMailer - PHP email class | Version: 5.1 ``` This version of PHPMailer is affected by the: `PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)` vulnerability also discovered by the author of this advisory and described in detail at: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html Similarly to recently disclosed exploit of WordPress Core 4.6 RCE: https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html remote attackers may exploit the phpmailer vulnerability in Vanilla Forums by passing the payload (additional parameters to `/usr/sbin/sendmail`) within the HOST header. For example, the following web request: ``` POST /vanilla2-3/entry/passwordrequest HTTP/1.1 Host: vanilla-forums-vhost -X Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Connection: close Content-Length: 149 hpt=&Target=discussions&ClientHour=2017-05-10+22%3A00&Email=admin&Request+a+new+password=Request+a+new+password&DeliveryType=VIEW&DeliveryMethod=JSON ``` would inject `-X` parameter at the end of the argument list passed to `/usr/bin/sendmail` : Arg no. 0 == [/usr/sbin/sendmail] Arg no. 1 == [-t] Arg no. 2 == [-i] Arg no. 3 == [-oi] Arg no. 4 == [-f] Arg no. 5 == [noreply@attackers_server] Arg no. 6 == [-X] ** NOTE:** It should be noted that this vulnerability can still be exploited even if Vanilla software is hosted on Apache web server with several name-based vhosts enabled, and despite not being the default vhost. This is possible as the attacker can take advantage of HTTP/1.0 protocol and specify the exact vhost within the URL. This will allow the `HOST ` header to be set to arbitrary value as the Apache server will obtain the `SERVER_NAME ` from the provided URL. This will ensure that the malicious request will reach the affected code despite invalid vhost within the `HOST` header. To demonstrate, the above web request could be simply modified to: ``` POST http://vanilla-forums-vhost/vanilla2-3/entry/passwordrequest HTTP/1.1 Host: arbitrary-string -X ``` to achieve the same effect on a host with multiple vhosts.
idSSV:93097
last seen2017-11-19
modified2017-05-12
published2017-05-12
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-93097
titleVanilla Forums <= 2.3 Unauth Remote Code Execution (CVE-2016-10033)

The Hacker News

idTHN:094F40699657A02740FF3A805B364AC1
last seen2018-01-27
modified2017-05-12
published2017-05-11
reporterMohit Kumar
sourcehttps://thehackernews.com/2017/05/vanilla-forum-vulnerability.html
title0-Day Flaws in Vanilla Forums Let Remote Attackers Hack Websites

References