Critical vulnerability in Vbullletin 3.x - Self-Submitting HTML Form Attacks

[WotC_Tech]

Originally Posted by Kier

I do not consider it to be a critical problem, as just about every web application out there can be exploited in this manner.

I won't argue that many web applications have this vulnerability, but I would like to point out the severity to other vB administrators. If an admin of your forum is tricked into visiting a web site containing one of these self-submitting forms, an attacker can gain administrative privileges on your forum, and perform other administrative tasks in the context of the admin who visited the malicious web site.

While this exploit requires some interaction from a site admin, it is not very difficult to trick someone into visiting a site.

[WotC_Tech]

Originally Posted by Kier

The code you have there is potentially problematic - try replacing it with this:

PHP Code:

if (!empty($_POST['do']) AND strpos(strtolower($_SERVER['HTTP_REFERER']), strtolower($_SERVER['HTTP_HOST'])) === false)
{
print_no_permission();
} 


To prevent bypassing this mechanism it might be better to check only the "host" portion of the referer:

PHP Code:

$parsed_referer=parse_url($_SERVER['HTTP_REFERER']);
if ((!empty($_POST['do'])) AND
  (strtolower($parsed_referer['host']) != strtolower($_SERVER['HTTP_HOST'])))
{ print_no_permission(); } 


Otherwise an attacker could simply append the hostname of the forum server to the end of the URL.

-Mike

[SaN-DeeP]

Originally Posted by Kier

Copy this code to a file called reftest.php and upload it to your server, then browse to the file and click the button on the page.

Done.. clicked the button and i got the proper message
Your HTTP referrer is http://www.tech-arena.com/reftest.php.

My Server aint vulnerable
Thank for help

Regards,

[WetWired]

Be aware that some internet privacy programs strip outgoing HTTP_REFFERER information, which will result in a very frustrating situation for some people if you use this fix; many will not even know that the privacy program is doing this.