vBulletin 4.0.8 - Persistent XSS via Profile Customization

[advisories@xxxxxxxxxxxx]

vBulletin - Persistent Cross Site Scripting via Profile Customization


Versions Affected: 4.0.8 (3.8.* is not vulnerable.)

Info:
Content publishing, search, security, and more? vBulletin has it all.
Whether it?s available features, support, or ease-of-use, vBulletin offers
the most for your money. Learn more about what makes vBulletin the
choice for people who are serious about creating thriving online communities.

External Links:
http://www.vbulletin.com

Credits: MaXe (@InterN0T)


-:: The Advisory ::-
vBulletin is prone to a Persistent Cross Site Scripting vulnerability within the
Profile Customization feature. If this feature is not enabled the vulnerability 
does not exist and the installation of vBulletin is thereby secure.

Within the profile customization fields, it is possible to enter colour codes,
rgb codes and even images. The image url() function does not sanitize user
input in a sufficient way causing vBulletin to be vulnerable to XSS attacks.

[1] Private Reflected XSS:
An attacker can inject scripts in a simple way, which is only visible to the 
attacker.

Proof of Concept:
url(</script><img src="x:x" 
onerror="alert(String.fromCharCode(73,110,116,101,114,78,48,84,11))" />)
(This is only visible to the attacker when he or she is logged in, and browsing 
his or her own profile.)

[2] Global Reflected XSS:
An attacker can inject malicious CSS data executing javascript, which is then 
visible
to anyone browsing the user profile. Even guests visiting the malicious user 
profile.

Proof of Concept: (IE6 only, may not work in IE7+ and FF)
url(/);background:url(javascript:document.write(1337))
url(/);width:expression(alert('www.intern0t.net'))


Please note that some of these strings may be too long to be injected. However a
blog entry at Exploit-DB and a video on YouTube will be released very soon.


-:: Solution ::-
Turn off profile customization immediately for users able to customize their 
profile!
When a security patch has been provided by the vendor, enable this feature 
again.


Disclosure Information:
- Vulnerability found and researched: 11th November 2010
- Vendor (vBulletin Solutions / IB) contacted: 11th November
- Disclosed to Exploit-DB, Bugtraq and InterN0T: 14th November

References:
http://forum.intern0t.net/intern0t-advisories/3349-vbulletin-4-0-8-persistent-xss-profile-customization.html
http://www.vbulletin.com/forum/showthread.php?366834-vbulletin-4-profile-customization-exploit
http://blip.tv/file/4381880
http://www.youtube.com/watch?v=LOcLFVAqgOU