Go Back   vb.org Archive > vBulletin Modifications > vBulletin 4.x Modifications > vBulletin 4.x Add-ons

Reply
 
Thread Tools
Patched Flash Uploader to Fix Known Exploits Details »»
Patched Flash Uploader to Fix Known Exploits
Version: 2.00, by alexm alexm is offline
Developer Last Online: Sep 2023 Show Printable Version Email this Page

Category: Miscellaneous Hacks - Version: 4.x.x Rating:
Released: 01-13-2014 Last Update: Never Installs: 205
Supported
Code Changes Additional Files  

UPDATE Dec 2014: 4.2.2 PL2, 4.2.2 PL3 and 4.2.3 core download packages from vBulletin now include this patched version of uploader.swf as standard.

This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads.

An exploit was found in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated.

vBulletin's recommended fix is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications.

This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin.

The YUI source used is provided freely by Yahoo to whom I give full credit.


1) Installation

a) Extract uploader.swf from the .zip file and replace your existing file here:

<forum_root>/clientscript/yui/uploader/assets/uploader.swf

b) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

c) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

d) You may also need to clear your browser cache and/or vBulletin cache (Maintenance ->Clear system cache) if you have performed the above steps correctly but clicking the Upload button still does nothing.



2) Changes

11th January 2014

The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string.


11th January 2014 v2

Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions
  • finding another exploit (using another parameter). Exploit fixed by setting the parameter (not used by vBulletin) to null.
  • '-' Character added to allowed characters in allowedDomain


Non-Flash Alternative
Please note that if you would rather avoid using flash altogether an alternative Mod has been released by BirdOPrey5, although there are some compromises/limitations with IE10+.

Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader


DISCLAIMER
I am not a flash developer, I am just another vBulletin customer trying to keep his members happy!
This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk!


Copyright ? 2013 Yahoo! Inc. All rights reserved.
Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Download Now

File Type: zip Patched_uploader.swf_2014-01-11v2.zip (9.3 KB, 990 views)

Show Your Support

  • This modification may not be copied, reproduced or published elsewhere without author's permission.

Comments
  #62  
Old 04-13-2014, 09:34 PM
K!nG K!nG is offline
 
Join Date: Dec 2010
Location: United States
Posts: 477
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Not working for me on 4.2.2 Patch level 1. Yes i also have flash upload enable in admincp. Any help ?

Thanks.
Reply With Quote
  #63  
Old 04-13-2014, 09:47 PM
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
Posts: 6,357
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by K!nG View Post
Not working for me on 4.2.2 Patch level 1. Yes i also have flash upload enable in admincp. Any help ?

Thanks.
explain the steps you took after downloading the plugin
Reply With Quote
  #64  
Old 04-14-2014, 12:35 AM
K!nG K!nG is offline
 
Join Date: Dec 2010
Location: United States
Posts: 477
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

After downloading i extracted the file to my desktop then i replaced the one i had and after that i checked into admincp to Make sure the flash uploader is enabled.

Now when i try to post an image from desktop by clicking on Inset Image icon, pop up comes and select from computer and when i click on Select Files nothing happens. It doesn't do anything.
Reply With Quote
  #65  
Old 04-14-2014, 03:08 AM
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
Posts: 6,357
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by K!nG View Post
After downloading i extracted the file to my desktop then i replaced the one i had and after that i checked into admincp to Make sure the flash uploader is enabled.

Now when i try to post an image from desktop by clicking on Inset Image icon, pop up comes and select from computer and when i click on Select Files nothing happens. It doesn't do anything.
So you logged into your ftp and when to clientscript/yui/uploader/assets
Folder and uploaded the uploader.swf file you mean?
Then when to your admincp/Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default
Reply With Quote
  #66  
Old 04-14-2014, 07:44 PM
K!nG K!nG is offline
 
Join Date: Dec 2010
Location: United States
Posts: 477
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Yes & Yes. Did exactly what was in instructions and what you just mentioned above, but nothing happened.
Reply With Quote
  #67  
Old 04-14-2014, 07:45 PM
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
Posts: 6,357
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

disable all plugins via config then test
Reply With Quote
  #68  
Old 04-14-2014, 09:24 PM
Zachery's Avatar
Zachery Zachery is offline
 
Join Date: Jul 2002
Location: Ontario, Canada
Posts: 11,440
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by K!nG View Post
Yes & Yes. Did exactly what was in instructions and what you just mentioned above, but nothing happened.
Does AdminCP > Maintenance > Diagnostics > Upload Test works?
ARe you using local, or remote YUI under the Server Settings / Optimization Options?
Reply With Quote
  #69  
Old 04-14-2014, 10:44 PM
K!nG K!nG is offline
 
Join Date: Dec 2010
Location: United States
Posts: 477
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by ForceHSS View Post
disable all plugins via config then test
I just disabled all plugins via config and nothing happened. Still not working. When i try to click on "Select Files" nothing happens.
Reply With Quote
  #70  
Old 04-14-2014, 10:49 PM
K!nG K!nG is offline
 
Join Date: Dec 2010
Location: United States
Posts: 477
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Zachery View Post
Does AdminCP > Maintenance > Diagnostics > Upload Test works?
ARe you using local, or remote YUI under the Server Settings / Optimization Options?
Here is what i got in diagonstics>Upload test.



I am using Remote YUI.
Reply With Quote
  #71  
Old 04-14-2014, 11:39 PM
Zachery's Avatar
Zachery Zachery is offline
 
Join Date: Jul 2002
Location: Ontario, Canada
Posts: 11,440
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

You can't use a REMOTE YUI, you have to use a local one. The SWF uploader on google/yahoo's servers have been removed.
Reply With Quote
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 05:59 AM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.08332 seconds
  • Memory Usage 2,353KB
  • Queries Executed 26 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (5)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)modsystem_post
  • (1)navbar
  • (4)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (4)pagenav_pagelink
  • (11)post_thanks_box
  • (20)post_thanks_box_bit
  • (11)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (1)post_thanks_postbit
  • (11)post_thanks_postbit_info
  • (10)postbit
  • (1)postbit_attachment
  • (11)postbit_onlinestatus
  • (11)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • fetch_musername
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • post_thanks_function_fetch_thanks_bit_start
  • post_thanks_function_show_thanks_date_start
  • post_thanks_function_show_thanks_date_end
  • post_thanks_function_fetch_thanks_bit_end
  • post_thanks_function_fetch_post_thanks_template_start
  • post_thanks_function_fetch_post_thanks_template_end
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_attachment
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete