Patched Flash Uploader to Fix Known Exploits
 

UPDATE Dec 2014: 4.2.2 PL2, 4.2.2 PL3 and 4.2.3 core download packages from vBulletin now include this patched version of uploader.swf as standard.

This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads.

An exploit was found in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated.

vBulletin's recommended fix is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications.

This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin.

The YUI source used is provided freely by Yahoo to whom I give full credit.


1) Installation

a) Extract uploader.swf from the .zip file and replace your existing file here:

<forum_root>/clientscript/yui/uploader/assets/uploader.swf

b) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

c) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

d) You may also need to clear your browser cache and/or vBulletin cache (Maintenance ->Clear system cache) if you have performed the above steps correctly but clicking the Upload button still does nothing.



2) Changes

11th January 2014

The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string.


11th January 2014 v2

Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions

• finding another exploit (using another parameter). Exploit fixed by setting the parameter (not used by vBulletin) to null.
• '-' Character added to allowed characters in allowedDomain

Non-Flash Alternative
Please note that if you would rather avoid using flash altogether an alternative Mod has been released by BirdOPrey5, although there are some compromises/limitations with IE10+.

Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader


DISCLAIMER
I am not a flash developer, I am just another vBulletin customer trying to keep his members happy!
This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk!


Copyright ? 2013 Yahoo! Inc. All rights reserved.
Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Thank you very much!!!

Thanks for the Patch.

Thank you :) I appreciate your time in fixing this issue

Stuart

Thanks very much for your work on this, it is much appreciated by many of us who miss the Flash functionality.

I'll get this installed on my own site in the next few days.

Thank You. :)

I'm always worried about when my vb4 will inevitably be forced to retire and in turn force me to move on to something else due to issues like this that arise.

Luckily there are still some great coders around supporting it. Unfortunately fewer and fewer these days though :(

Thanks for the fix.

Thank you 100x over.

thank you for you time and the patch.

Great work, thank you!

thank you installed

Thank you

Thank very much!

Hi
Excellent work and has saved many of us from lots of trouble on our forums.
Many thanks.

Thanks man! I also nominated this mod to MOTM.

ive done this but for some reason when I click select files a new box to browse computer files does not pop up? And ideas?

Try clearing your browser cache

Irrelevant posts and comments removed.

This is a modification release thread, not another "lets attack IB" thread.

Thx

cleared browser like recommended and this worked, now working perfectly in 4.2.2 Thank you so so much

Working on vBulletin 4.2.2, thank you very much

Thank you so much for taking the time to fix this, and to make it available to the rest of us! :)

Tanks for the fix!

This should be included as a patch to all VB installs. Thank you very much!

This should definitely be included as a patch! Thanks!

In vb 4.2.2 works...

Thank you

Cool. Let's see if anybody at my site notices.

Thank you so much. This issue was difficult to track down. Multiple images is very important to our users. Clearing the browser cache was the final missing piece. Thank you!

Many thanks for this fix. :) It was an good idea!

I'll install it approximately in just one forum (just for testing it) and maybe later on in all the remaining ones.

Well I cant say I fully understood what the issue was only that there was one.
I have installed this fix and have experienced no noticeable change or issues.

whatever the problem was it is fixed and I thank you very very much for your efforts.

Thanks!!!!!

MOD of the month this month surely....

Well done in advance alexm.....

Voted!

Kinda sad that basic maintenance ends up being so praiseworthy. We've long giving up on features or improvements.

MUCH MUCH appreciated, big +1

Uploaded the file and the button still doesnt work - im sure I missed some step ...

This is great , i was looking for this solution , the response from Vbulletin official team on this issue was hopeless ,

but alexm you have taken the right step , great work. thanks.

Thanks for this big help !!

Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.

Thanks for the Patch.