mailing list archives
vBulletin 4.0.8 - Persistent XSS via Profile Customization
From: advisories () intern0t net
Date: Sun, 14 Nov 2010 17:40:35 -0700
vBulletin - Persistent Cross Site Scripting via Profile Customization
Versions Affected: 4.0.8 (3.8.* is not vulnerable.)
Content publishing, search, security, and more vBulletin has it all.
Whether its available features, support, or ease-of-use, vBulletin offers
the most for your money. Learn more about what makes vBulletin the
choice for people who are serious about creating thriving online communities.
Credits: MaXe (@InterN0T)
-:: The Advisory ::-
vBulletin is prone to a Persistent Cross Site Scripting vulnerability within the
Profile Customization feature. If this feature is not enabled the vulnerability
does not exist and the installation of vBulletin is thereby secure.
Within the profile customization fields, it is possible to enter colour codes,
rgb codes and even images. The image url() function does not sanitize user
input in a sufficient way causing vBulletin to be vulnerable to XSS attacks.
 Private Reflected XSS:
An attacker can inject scripts in a simple way, which is only visible to the attacker.
Proof of Concept:
url(</script><img src="x:x" onerror="alert(String.fromCharCode(73,110,116,101,114,78,48,84,11))" />)
(This is only visible to the attacker when he or she is logged in, and browsing his or her own profile.)
 Global Reflected XSS:
to anyone browsing the user profile. Even guests visiting the malicious user profile.
Proof of Concept: (IE6 only, may not work in IE7+ and FF)
Please note that some of these strings may be too long to be injected. However a
blog entry at Exploit-DB and a video on YouTube will be released very soon.
-:: Solution ::-
Turn off profile customization immediately for users able to customize their profile!
When a security patch has been provided by the vendor, enable this feature again.
- Vulnerability found and researched: 11th November 2010
- Vendor (vBulletin Solutions / IB) contacted: 11th November
- Disclosed to Exploit-DB, Bugtraq and InterN0T: 14th November
- vBulletin 4.0.8 - Persistent XSS via Profile Customization advisories (Nov 15)