From c531760ff3cad8ca4cb65df5f2b4bafa62bc4589 Mon Sep 17 00:00:00 2001 From: Church of Malware <3+ek0ms@noreply.git.churchofmalware.org> Date: Mon, 29 Jun 2026 16:50:59 +0000 Subject: [PATCH] Upload files to "mybb-limited-acp-to-admin" --- mybb-limited-acp-to-admin/LICENSE | 21 ++++ mybb-limited-acp-to-admin/README.md | 165 ++++++++++++++++++++++++++ mybb-limited-acp-to-admin/SECURITY.md | 7 ++ 3 files changed, 193 insertions(+) create mode 100644 mybb-limited-acp-to-admin/LICENSE create mode 100644 mybb-limited-acp-to-admin/README.md create mode 100644 mybb-limited-acp-to-admin/SECURITY.md diff --git a/mybb-limited-acp-to-admin/LICENSE b/mybb-limited-acp-to-admin/LICENSE new file mode 100644 index 0000000..14fac91 --- /dev/null +++ b/mybb-limited-acp-to-admin/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/mybb-limited-acp-to-admin/README.md b/mybb-limited-acp-to-admin/README.md new file mode 100644 index 0000000..7c85c33 --- /dev/null +++ b/mybb-limited-acp-to-admin/README.md @@ -0,0 +1,165 @@ +# MyBB 1.8.40 Limited ACP User Manager to Full Administrator + +This repository contains a portable proof of concept for a MyBB 1.8.40 Admin CP privilege-boundary issue. + +A non-super Admin CP account with only the user-management module permission can create a new user in the Administrator group (`gid=4`). The created account inherits full Administrator-group Admin CP permissions, including access to modules the source account was explicitly denied. + +## Status + +- Target verified: MyBB `1.8.40` / version code `1840` +- Latest release confirmed: MyBB 1.8.40, released 28 May 2026 +- Live test date: 18 June 2026 +- PoC language: Python 3 standard library only + +The older regular-user buddy/ignore-list username XSS chain is patched in 1.8.40 as CVE-2026-45115. This repo is for a different latest-version issue: limited ACP user-management privilege escalation to full Administrator. + +## Impact + +The final impact is full MyBB application administration: + +- Read and modify board configuration. +- Create, edit, ban, or delete users. +- Access forum data exposed through the Admin CP. +- Change content, permissions, settings, themes, templates, and persistence mechanisms available to Administrators. + +This has the same final application-root impact as the earlier stored-XSS-to-Admin-CP chain, but the precondition is different and stricter: the attacker needs access to an ACP account that can manage users. + +## Preconditions + +The source account must: + +- Be authenticated to the Admin CP. +- Have `user-users = 1` permission. +- Not need to be a super administrator. +- Not need `user-admin_permissions = 1`. +- Not need access to unrelated Admin CP modules such as Configuration, Templates, Tools, or Forums. + +## Root Cause + +The Admin CP add-user flow forwards submitted group fields directly into the user data handler: + +```php +"usergroup" => $mybb->get_input('usergroup'), +"additionalgroups" => $additionalgroups, +"displaygroup" => $mybb->get_input('displaygroup'), +``` + +The add-user form renders every non-guest user group, including `gid=4` Administrator: + +```php +$query = $db->simple_select("usergroups", "gid, title", "gid != '1'", array('order_by' => 'title')); +``` + +The user data handler still accepts group choices unconditionally: + +```php +function verify_usergroup() +{ + return true; +} +``` + +There is no effective authorization check that the acting ACP user is allowed to grant an ACP-capable group. + +## Usage + +Use only on systems you own or are explicitly authorized to test. + +With limited ACP credentials: + +```bash +python3 poc/mybb_limited_acp_to_admin.py \ + --url http://127.0.0.1:8110 \ + --admin-user limited_user_manager \ + --admin-pass 'LimitedPassword123!' \ + --new-user promoted_admin \ + --new-pass 'NewAdminPassword123!' \ + --new-email promoted_admin@example.test +``` + +With an existing limited ACP `adminsid` cookie: + +```bash +python3 poc/mybb_limited_acp_to_admin.py \ + --url https://forum.example.test \ + --adminsid '' \ + --new-user promoted_admin \ + --new-pass 'NewAdminPassword123!' \ + --new-email promoted_admin@example.test +``` + +For local labs using self-signed TLS, add `--no-verify-tls`. + +## Expected Output + +The PoC verifies the boundary crossing by comparing access to an Admin CP module before and after creating the new account: + +```text +target : http://127.0.0.1:8110 +source_probe_status : HTTP 200 +source_probe_denied : yes +add_form_status : HTTP 200 +post_key_found : yes +create_status : HTTP 200 +new_admin_login : adminsid issued +new_probe_status : HTTP 200 +new_probe_denied : no + +Result: full Administrator account created and verified +``` + +`source_probe_denied=yes` and `new_probe_denied=no` show that the source account lacked the tested permission while the newly created gid-4 account gained it. + +## Live Verification Performed + +I verified this against a fresh 1.8.40 install: + +- Downloaded `mybb_1840.zip` from MyBB resources. +- Verified SHA-256: `380fb63c50c63f52c747ba05d1002ad77f2f0b1d254db213092501dd5e9375dc`. +- Installed through the official installer using SQLite. +- Confirmed code version from `inc/class_core.php`: `1.8.40 (1840)`. +- Seeded a non-super ACP account with only `user-users = 1`. +- Confirmed that account received `Access Denied` for `config-settings`. +- Used the Admin CP add-user form to create a new `gid=4` Administrator. +- Logged in as the new account and confirmed `config-settings` was no longer denied. + +The Python PoC was also run against the live lab and produced the expected verified output above. + +## Patched Prior Chain + +The previous MyBB 1.8.39 buddy-selector stored XSS relied on stock templates passing attacker-controlled username data into a single-quoted inline JavaScript call: + +```html +onclick="UserCP.selectBuddy('{$buddy['uid']}', '{$buddy['username']}');" +``` + +In stock MyBB 1.8.40, the affected templates now call `UserCP.selectBuddy()` without the username argument: + +```html +onclick="UserCP.selectBuddy();" +``` + +That removes the old username-to-inline-JS sink in the default template set. + +## Suggested Fix + +When an ACP user creates or edits accounts, reject any primary, additional, or display group with Admin CP capability unless the acting user is a super administrator or has an explicit high-trust permission to grant ACP-capable groups. + +Concrete checks should cover: + +- Add-user flow. +- Edit-user flow. +- Inline/mass usergroup update flow. +- Any plugin hooks or alternate paths that call the user data handler with group fields. + +Defense-in-depth: make `UserDataHandler::verify_usergroup()` enforce group grant rules instead of returning `true`. + +## References + +- [MyBB 1.8.40 version page](https://mybb.com/versions/1.8.40/) +- [MyBB 1.8.40 release announcement](https://blog.mybb.com/2026/05/28/mybb-1-8-40-released-security-maintenance-release/) +- [MyBB releases on GitHub](https://github.com/mybb/mybb/releases) + +## Responsible Use + +This PoC is for authorized security testing, regression verification, and defensive remediation. Do not use it against systems without permission. diff --git a/mybb-limited-acp-to-admin/SECURITY.md b/mybb-limited-acp-to-admin/SECURITY.md new file mode 100644 index 0000000..f37e1fe --- /dev/null +++ b/mybb-limited-acp-to-admin/SECURITY.md @@ -0,0 +1,7 @@ +# Security Policy + +This repository documents an authorized local verification of a MyBB privilege-boundary issue. + +Use the PoC only against systems you own or have explicit permission to test. If you are validating a production forum, coordinate with the forum owner and preserve evidence without exposing user data. + +Suggested disclosure path: report MyBB core security issues through the MyBB Project security process at https://mybb.com/security/.