vBulletin 5.0.4 hacked on secure server

[kellym]

I was very dismayed today to find my vBulletin 5.0.4 has been hacked. I work in the IT industry and my server infrastructure is definitely secure, in fact it runs on a dedicated BSD Unix host server using the same configuration as my e-commerce servers, which process credit card transactions every day and have never been hacked. I have no remote access into the system enabled except via strong 4096-bit SSH host keys, I'm currently running Apache apache22-2.2.25, PHP 5.4.17, and MySQL 5.6.13. The web server itself runs inside a CHROOT JAIL environment on the latest patched version of FreeBSD 8.4, the host is *not* compromised, and the apache daemon and mysql daemon are both isolated from the host operating system. I also run a file integrity monitoring tool from outside of the jail looking in, and have found no changes were made to the filesystem when it was hacked. That tells me there's a vulnerability in vBulletin 5.0.4 itself that was exploited and messed up my database. Fortunately I have daily backups and can roll back, but that doesn't fix the issue of *how* it was hacked. My PHP is very slightly out-of-date (5.4.20 is the latest of the 5.4.x branch) but it's unlikely that's the cause. My vBulletin admin password is unique to the site and is more than 20 characters long. No one else has admin access to the application, and absolutely no one has access to the server host root except me.

I did not see any major security holes plugged in vBulletin 5.0.5 so I'm wondering what's up. I haven't read all the release notes for 5.0.5 however. I have all apache logs available for the vBulletin team to review. To be honest I'm a little pissed that this has happened and would like to get to the bottom of this. vBulletin team, please let me know how I can get you the logs, they are large. I don't know what day or time the system was hacked but I'm sure it's all in the logs. The website is www.sjwinfo.org, a public service website about treating depression.

thanks,
Kelly

[glennrocksvb]

You didn't delete the install directory after install/upgrade. I can still access it now! There are blogs here on what to do after being hacked. I'm on the phone so it's hard to post the links here.

[kellym]

You didn't delete the install directory after install/upgrade. I can still access it now! There are blogs here on what to do after being hacked. I'm on the phone so it's hard to post the links here.

Glenn, you are right and thank-you very much for finding this. It's absolutely my mistake and I must have skipped that step during the last upgrade.

I will however need to take vBulletin to task for not making it more clean in the upgrade process that /core/install needs to be DELETED before continuing. Every time there is an upgrade, it's too easy to forget to delete that directory. Why not display a message at the install (or upgrade) process in big, bold red print reminding users? It's a pretty important step not to skip. It's also likely that your script could delete most or all of that folder itself using PHP native filesystem commands.

Also, the security alert messages that vBulletin displays when a /core/install directory remains are misleading. For example, it only provides a warning that says "install.php still remains in the /install/ directory. This poses a security risk, so please delete that file immediately. You cannot access the control panel until you do so." n Instead, why don't you instead tell users that the entire /core/install directory should be deleted? This would be much more logical.

Anyway, I've recovered my forum but lost about two weeks of posts. It was the only safe place I could roll back to after a review of the web server logs.

Kelly

[Zachery]

5.0.5 won't let you into the AdminCP, without deleting the entire folder.