Advisory: Stored XSS-Vulnerabilities in MyBB v. 1.8.3
Advisory ID: SROEADV-2015-15
Author: Steffen Rösemann
Affected Software: MyBB v. 1.8.3
Vendor URL: http://www.mybb.com
Vendor Status: patched
CVE-ID: -
==========================
Vulnerability Description:
==========================
MyBB v. 1.8.3 suffers from multiple stored XSS-vulnerabilities in the
administrative backend.
==================
Technical Details:
==================
The stored XSS-vulnerabilities can be found in different modules in the
following locations of a common MyBB installation:
======================
Module "config-attachment_types"
======================
via form-field MIME-type:
http://{TARGET}/admin/index.
executed in: e.g. http://
{TARGET}/admin/index.php?
===============
Module "config-mycode"
===============
via form fields "title" and "short description":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
===================
Module "forum-management"
===================
via form field "title":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
==============
Module "user-groups"
==============
via form fields "title" and/or "short description":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
================
Module "style-templates"
================
via form field "name":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
==============================
Module "style-templates" in action "add_template_group"
==============================
via form field "title":
http://
{TARGET}/admin/index.php?
executed in: e.g. http://
{TARGET}/admin/index.php?
=============
Module "tool-tasks"
=============
via form field "title":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
=================
Module "config-post_icons"
=================
via form field "name":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
=============
Module "user-titles"
=============
via form field "title to assign":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
================
Module "config-banning"
================
via form field "username":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
=========
Solution:
=========
Upgrade to v. 1.8.4.
====================
Disclosure Timeline:
====================
02/03-Feb-2015 – found the vulnerabilities
03-Feb-2015 - informed the developers according to their security issue
rules (see [3])
03-Feb-2015 – release date of this security advisory [without technical
details]
03-Feb-2015 - vendor replied, issues will be patched
15-Feb-2015 - vendor released patch v. 1.8.4 (see [4])
19-Feb-2015 - release date of this security advisory
19-Feb-2015 - send to FullDisclosure
========
Credits:
========
Vulnerability found and advisory written by Steffen Rösemann.
===========
References:
===========
[1] http://www.mybb.com
[2] http://sroesemann.blogspot.de/
[3] http://www.mybb.com/get-
[4]
http://blog.mybb.com/2015/02/
Advisory ID: SROEADV-2015-15
Author: Steffen Rösemann
Affected Software: MyBB v. 1.8.3
Vendor URL: http://www.mybb.com
Vendor Status: patched
CVE-ID: -
==========================
Vulnerability Description:
==========================
MyBB v. 1.8.3 suffers from multiple stored XSS-vulnerabilities in the
administrative backend.
==================
Technical Details:
==================
The stored XSS-vulnerabilities can be found in different modules in the
following locations of a common MyBB installation:
======================
Module "config-attachment_types"
======================
via form-field MIME-type:
http://{TARGET}/admin/index.
executed in: e.g. http://
{TARGET}/admin/index.php?
===============
Module "config-mycode"
===============
via form fields "title" and "short description":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
===================
Module "forum-management"
===================
via form field "title":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
==============
Module "user-groups"
==============
via form fields "title" and/or "short description":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
================
Module "style-templates"
================
via form field "name":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
==============================
Module "style-templates" in action "add_template_group"
==============================
via form field "title":
http://
{TARGET}/admin/index.php?
executed in: e.g. http://
{TARGET}/admin/index.php?
=============
Module "tool-tasks"
=============
via form field "title":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
=================
Module "config-post_icons"
=================
via form field "name":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
=============
Module "user-titles"
=============
via form field "title to assign":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
================
Module "config-banning"
================
via form field "username":
http://{TARGET}/admin/index.
executed in: e.g. http://{TARGET}/admin/index.
=========
Solution:
=========
Upgrade to v. 1.8.4.
====================
Disclosure Timeline:
====================
02/03-Feb-2015 – found the vulnerabilities
03-Feb-2015 - informed the developers according to their security issue
rules (see [3])
03-Feb-2015 – release date of this security advisory [without technical
details]
03-Feb-2015 - vendor replied, issues will be patched
15-Feb-2015 - vendor released patch v. 1.8.4 (see [4])
19-Feb-2015 - release date of this security advisory
19-Feb-2015 - send to FullDisclosure
========
Credits:
========
Vulnerability found and advisory written by Steffen Rösemann.
===========
References:
===========
[1] http://www.mybb.com
[2] http://sroesemann.blogspot.de/
[3] http://www.mybb.com/get-
[4]
http://blog.mybb.com/2015/02/