ajax.php arbitrary execution and directory traversal

**djbaxter** · Mon 28 May '18, 1:22am

What specific version of vBulletin 4?

**archangel122184** · Mon 28 May '18, 3:51am

The latest patch, 4.2.5

**djbaxter** · Mon 28 May '18, 5:38am

It's Memorial Day in the US so you'll probably have to wait until tomorrow for a response.

Previous similar reports, though, occurred while the install directory remained on the server. make sure that the entire /install/ directory is deleted.

Also, disable ImageMagick and use the GD image library AdminCP >> Options >> Image Settings

You should also run Admin CP -> Maintenance - > Diagnostics -> Suspect File Check

**archangel122184** · Mon 28 May '18, 6:22am

Install directory has been deleted. ImageMagick isn't installed.

**Wayne Luke** · Tue 29 May '18, 8:54am

I've spoken to our developers and this looks like a Hook or Plugin Exploit. It is using parameters that we do not allow in vBulletin. In a normal situation, these would be dropped and the system should carry on. However, the AJAX system can be hooked into using vBulletin 4's standard plugin system.

Make sure there are no unknown plugins on the ajax_complete hook in your AdminCP (if any are shown). AdminCP -> Products & Plugins -> Plugin Manager.
Make sure there are no unknown plugins on the ajax_start hook in your AdminCP (if any are shown). AdminCP -> Products & Plugins -> Plugin Manager.
Run this query: "select * from plugin where hookname='ajax_complete' or hookname='ajax_start';" Delete any that are unknown, especially if they
Run this query: "delete from datastore where title in ('pluginlist', 'pluginlistadmin');"

**archangel122184** · Tue 29 May '18, 9:09am

Thank you. That helps and you are correct. I found an ajax_complete plugin processing the "ipn" option. The plugin is not part of any installed product, it just falls in the vbulletin category.

That suggest then that there was an SQL injection performed against the VB installation. I'll check the database backups to see if I can isolate when this was injected, but are there presently any known SQL injection vulnerabilities in vb 4.2.5?

**Wayne Luke** · Tue 29 May '18, 9:48am

On a properly secured vBulletin 4.2.5 site, there are no currently known SQL injection vectors.

**archangel122184** · Tue 29 May '18, 10:09am

I was able to trace the plugin to an admin that created it in Dec 2016. I don't see anything suspicious with the control panel logs (no spurious or duplicate log ids, no timeshifting/out of order time stamps) so chances are the admin's account was compromised almost 2 years ago and we've been at risk for a long time. Strange that the plugin just now started being used. Either way, thank you very much for your help. My users will appreciate having ajax back.

**Wayne Luke** · Tue 29 May '18, 11:18am

We did have some security issues in the past and released both guidance and security patches to deal with them. It could have been during that time. It isn't uncommon for the admin logs to be tampered with during exploits. There are also people who create exploits and let them sleep until they decide they need them. I am glad the fix was relatively quick.

Please run the Suspect File Versions tool under Maintenance -> Diagnostics and make sure that there are no unknown files in the vBulletin directory.

vBulletin 4 End of Life

ajax.php arbitrary execution and directory traversal

ajax.php arbitrary execution and directory traversal

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment