Critical vulnerability in Vbullletin 3.x - Self-Submitting HTML Form Attacks

[Kier]

Originally Posted by Michael Morris

I submitted this to vb3 but since I have a fix I thought I'd share it.

Vbulletin forums can be attacked from self submitting forms. Basically you write a small html file with a self submitting form to make a post, change signature, maybe change a password. You then submit a link on the post inviting curious board members to follow it. When they do, it does it's evil magic, using their cookie or session variable for authorization.

To block this nasty attack, use the PHPINCLUDE_START template to verify that all attempts to execute a $_POST action originate from your boards.

PHP Code:

if (!empty($_POST['do']) AND !strstr($_SERVER['HTTP_REFERER'], "YOURBOARDSURL")) 
{ 
    print_no_permission();
} 


Replace YOURBOARDSURL with, well, your boards url.

The code you have there is potentially problematic - try replacing it with this:

PHP Code:

if (!empty($_POST['do']) AND strpos(strtolower($_SERVER['HTTP_REFERER']), strtolower($_SERVER['HTTP_HOST'])) === false)
{
print_no_permission();
} 


It should also be noted that if your webserver is one of the rare ones that does not set an HTTP referrer, this code will break vBulletin and prevent just about any kind of interaction with it.