A significant cybersecurity issue has surfaced concerning Vanilla Forums, open-source software utilized by over 500,000 websites for online discussions. A Polish security researcher, Dawid Golunski of Legal Hackers, has publicly disclosed two critical zero-day vulnerabilities, potentially allowing unauthenticated remote attackers to compromise targeted websites with relative ease.
The vulnerabilities are distinct yet interconnected: a remote code execution flaw (CVE-2016-10033) and a host header injection flaw (CVE-2016-10073). Both vulnerabilities persist in the latest version of Vanilla Forums, leaving a vast number of websites, and the millions of users relying on them, exposed to a range of cyberattacks.
Golunski’s findings indicate that these vulnerabilities arise from the software’s reliance on an outdated version of PHPMailer, one of the most widely used PHP libraries for sending emails. In a critical earlier disclosure, Golunski identified serious remote code execution vulnerabilities within PHPMailer that enable attackers to execute arbitrary code on affected systems. This flaw manifests similarly in Vanilla Forums, as evidenced in a proof-of-concept video where the researcher showcased how combining the PHPMailer exploit with host header injection enables attackers to inject malicious commands and payloads through the HOST header.
The host header injection vulnerability can be leveraged independently to hijack user accounts, including administrative accounts, by sending spoofed HTTP requests. An attacker could exploit this flaw during a password reset process by manipulating the HOST header to a malicious domain. This method echoes similar exploitation techniques seen in recent WordPress vulnerabilities, further showcasing the range of risks associated with host header manipulations.
Golunski initially reported these vulnerabilities to the Vanilla Forums team in January. However, the response was delayed, leading to the public disclosure of these issues after a five-month period of silence from the company. The researcher has confirmed that the vulnerabilities remain in the current stable version of Vanilla Forums, version 2.3, and posits that earlier versions are also at risk.
In light of these ongoing vulnerabilities, Golunski has recommended website administrators employ temporary mitigations, such as setting the sender’s email address to a static value, to thwart the impact of the host header exploitation. However, it is crucial for affected users to update their software to the latest version to safeguard against potential attacks.
In a recent update, Vanilla Forums announced they have addressed the disclosed vulnerabilities in version 2.3.1, clarifying that these issues solely affected their free and open-source offerings, and asserting that their cloud-based products were not impacted at the time of publication. Users of the open-source software are strongly encouraged to make the necessary updates to ensure their websites remain secure.
The vulnerabilities expose potential avenues for exploitation involving MITRE ATT&CK tactics including initial access through external remote services, privilege escalation via code execution, and potential persistence methods following exploitation. Cybersecurity professionals should remain vigilant and proactive in their approach to software updates and vulnerability management to mitigate such risks effectively.