Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw 已修复的vBulletin预认证代码执行漏洞公开利用程序发布

TL;DR

• A public exploit was released for a patched pre-authentication remote code execution (RCE) vulnerability in vBulletin's template engine, specifically CVE-2026-61511.
• The vulnerability allows unauthenticated attackers to execute arbitrary PHP code via the eval() function by manipulating the {vb:math} tag in the pagenav parameter through the ajax/render/pagenav endpoint.
• The attack uses a "phpfuck" technique—reconstructing PHP strings and function calls using only digits, parentheses, and arithmetic operators—to bypass character filtering and call system functions like system().
• Although vBulletin patched versions 6.2.1, 6.2.0, and 6.1.6 in late June and released version 6.2.2 on July 1, self-hosted installations remain at risk if not updated, especially those exposed to the internet.
• No confirmed active exploitation was reported as of July 27, 2026, but the window between patching and public disclosure raises concerns about potential undetected attacks.

Why It Matters

This incident underscores the persistent risk posed by legacy or unpatched content management systems, particularly those with publicly accessible administrative-like functionality—even without authentication. For AI practitioners and security researchers, it highlights how seemingly minor logic flaws in template engines can be weaponized into full RCE chains when combined with creative code obfuscation techniques like "phpfuck." The delayed public disclosure after patching also illustrates the tension between responsible disclosure and real-world threat exposure, urging organizations to prioritize timely updates and proactive monitoring of vulnerable components.

Technical Details

• Vulnerability Location: The flaw resides in /includes/vb5/template/runtime.php, within the vB5_Template_Runtime::runMaths() method, which processes inline mathematical expressions in templates.
• Attack Vector: An attacker sends a POST request to ajax/render/pagenav with a crafted pagenav[pagenumber] value containing a {vb:math} tag that includes malicious arithmetic expressions designed to reconstruct PHP code without using letters.
• Filter Bypass Technique ("phpfuck"): The input filter blocks alphabetic characters but permits digits, +, -, *, /, (, ), ., and XOR (^). Attackers use these allowed characters to build numeric values and concatenate them into valid PHP strings—for example, constructing 'system' as (1<<4)+(1<<3)+(1<<2)+(1<<1)+1 or similar bitwise/arithmetic combinations.
• Code Execution Chain: The filtered output is passed directly to PHP’s eval(), allowing execution of reconstructed commands such as system('id'), with results returned in the HTTP response body.
• Patch Status: vBulletin released fixes for affected versions in late June and version 6.2.2 on July 1; Cloud instances were already secured. Self-hosted users must manually apply patches or upgrade.
• Exploit Characteristics: The public PoC contains a one-character typo (a letter instead of a digit), rendering it non-functional until corrected—a minor issue that does not undermine the underlying vulnerability.

Industry Insight

Organizations relying on third-party CMS platforms like vBulletin should implement automated patch management workflows and regularly audit their software inventory to identify outdated or unpatched instances, especially those exposed to public networks. Security teams should monitor traffic patterns for anomalies in template-rendering endpoints, particularly POST requests with complex or operator-heavy payloads in math-related parameters, as early indicators of exploitation attempts. Additionally, the recurrence of similar vulnerabilities in vBulletin’s template engine suggests a systemic need for stricter input validation and sandboxing of dynamic evaluation contexts across web frameworks, reinforcing the importance of adopting secure-by-design principles in application development and maintenance.

TL;DR

• 漏洞CVE-2026-61511为vBulletin模板引擎中的未认证远程代码执行（RCE）缺陷，攻击者无需登录即可利用。
• 该漏洞位于/includes/vb5/template/runtime.php的runMaths()方法中，通过过滤后的字符绕过限制调用PHP的eval()函数。
• 攻击者可构造特殊输入重建PHP系统函数并执行操作系统命令，实现完全控制服务器。
• vBulletin已于6月底发布补丁，7月1日推出修复版本6.2.2，但自托管实例仍面临风险。
• SSD于7月27日公开exploit细节，但存在拼写错误；目前无活跃野外攻击记录，CISA未将其列入已知被利用漏洞目录。

为什么值得看

本文揭示了一个典型的“先修复后披露”安全事件模式，强调了及时更新软件的重要性，尤其对于依赖第三方CMS的企业而言。同时展示了攻击者如何利用语言特性（如“phpfuck”技巧）绕过输入过滤，对开发者和安全团队具有警示意义。

技术解析

• 漏洞位置：发生在vBulletin的模板渲染模块中，具体路径为/includes/vb5/template/runtime.php，涉及类vB5_Template_Runtime的方法runMaths()。
• 触发机制：用户可通过公共接口ajax/render/pagenav提交请求，其中参数pagenav[pagenumber]会被直接传入{vb:math}标签进行处理。
• 绕过方式：虽然代码试图限制只允许数字、括号及运算符等字符，但仍能通过组合这些符号构建合法的PHP表达式，进而间接调用危险函数如system()或eval()。
• 攻击链示例：PoC利用上述逻辑构造出一个看似无害但实际上能执行任意shell命令的有效载荷，最终返回结果给客户端。
• 验证环境：Hacker News本地复现时发现原始脚本含有一处字符错误（字母误作数字），修正后可成功运行测试负载确认漏洞真实性。

行业启示

• 组织应建立自动化监控与快速响应机制，确保关键组件一旦有新补丁即完成升级，避免长期暴露于已知威胁之下。
• 针对Web应用防火墙（WAF）规则优化建议增加对异常长字符串或高频运算符组合的检测能力，以识别潜在的攻击尝试。
• 开发者在设计输入校验逻辑时需充分考虑边缘情况，避免单纯依靠白名单策略而忽视复杂编码变换带来的安全隐患。