Critical RCE Flaw Reported in MyBB Forum Software—Patch Your Sites

A pair of critical vulnerabilities in a popular bulletin board
software called MyBB could have been chained together to achieve
remote code execution (RCE) without the need for prior access to a
privileged account.

The flaws, which were discovered by independent security
researchers Simon Scannell and Carl Smith, were reported to the
MyBB Team on February 22, following which it released^[1]
an update (version 1.8.26) on March 10 addressing the issues.

MyBB, formerly MyBBoard and originally MyBulletinBoard, is free
and open-source forum software developed using PHP and MySQL.

According to the researchers, the first issue — a nested auto
URL persistent XSS vulnerability (CVE-2021-27889) — stems from how
MyBB parses messages containing URLs during the rendering process,
thus enabling any unprivileged forum user to embed stored XSS
payloads into threads, posts, and even private messages.

“The vulnerability can be exploited with minimal user
interaction by saving a maliciously crafted MyCode message on the
server (e.g. as a post or Private Message) and pointing a victim to
a page where the content is parsed,” MyBB said^[2]
in an advisory.

The second vulnerability concerns an SQL injection (CVE-2021-27890^[3]) in a forum’s theme
manager that could result in an authenticated RCE. A successful
exploitation occurs when a forum administrator with the “Can manage
themes?” permission imports a maliciously crafted theme, or a user,
for whom the theme has been set, visits a forum page.

“A sophisticated attacker could develop an exploit for the
Stored XSS vulnerability and then send a private message to a
targeted administrator of a MyBB board,” the researchers outlined^[4]
in a technical write-up. “As soon as the administrator opens the
private message, on his own trusted forum, the exploit triggers. An
RCE vulnerability is automatically exploited in the background and
leads to a full takeover of the targeted MyBB forum.”

Besides the two aforementioned vulnerabilities, version 1.8.26
also resolves four other security shortcomings that were identified
by the MyBB Team, including —

• CVE-2021-27946^[5]
  – Improper validation of the number of votes in thread poll
  options, leading to SQL injection
• CVE-2021-27947^[6]
  – Improper sanitization of certain forum data, causing SQL
  injection when used in subsequent queries
• CVE-2021-27948^[7]
  – Additional User Groups ID numbers can be saved without proper
  validation in the Admin Control Panel, resulting in SQL injection,
  and
• CVE-2021-27949^[8]
  – A reflected XSS vulnerability in custom Moderator Tools, when
  user input attached to CSRF token-protected POST requests is not
  properly sanitized

MyBB users are advised to upgrade to the latest
version^[9] to mitigate the risk
associated with the flaws.