Exploits in the Wild Target vBulletin Pre-Auth RCE CVE-2020-17496

Attackers actively exploited CVE-2020-17496, a pre-authentication remote code execution flaw in vBulletin, to run arbitrary PHP code on vulnerable forums. The bug bypassed the earlier fix for CVE-2019-16759 by abusing vBulletin’s template rendering logic, specifically the widget_tabbedcontainer_tab_panel template to indirectly invoke widget_php. Palo Alto Networks Unit 42 reported exploitation beginning shortly after disclosure, with multiple unrelated actors scanning for exposed systems and attempting remote command execution.

Observed attacks included reading sensitive files such as /etc/passwd, writing PHP web shells, and delivering additional malware. Unit 42 said intruders used the vulnerability to download a Perl-based Shellbot and a Mirai variant known as Sora, underscoring the risk of both persistent compromise and botnet recruitment. vBulletin issued a patch for affected versions, and organizations running the software were urged to update immediately because of the broad installed base and ongoing exploitation.