Server Side Request Forgery (SSRF) Vulnerability

SEC Consult Vulnerability Lab Security Advisory < 20170407-0 >


title: Server Side Request Forgery (SSRF) Vulnerability

product: MyBB

vulnerable version: 1.8.10

fixed version: 1.8.11

CVE number: CVE-2017-7566

impact: Medium


found: 2017-03-03

by: Wan Ikram (Office Kuala Lumpur)

Fikri Fadzil (Office Kuala Lumpur)

Jasveer Singh (Office Kuala Lumpur)

SEC Consult Vulnerability Lab


An integrated part of SEC Consult

Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow

Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich




Vendor description:


"With everything from forums to threads, posts to private messages, search to

profiles, and reputation to warnings, MyBB features everything you need to run

an efficient and captivating community. Through plugins and themes, you can

extend MyBB's functionality to build your community exactly as you'd like it."





Business recommendation:


The patch should be installed immediately if cURL functions are disabled.


Furthermore, SEC Consult recommends to perform a thorough security review of

this software.



Vulnerability overview/description:


1. Server-Side Request Forgery

An attacker is able to initiate socket connections with arbitrary systems using

the internal network interface of the server via the web application's "Change

Avatar" function. This vulnerability can be used to identify internal hosts and

perform internal port scanning.



Proof of concept:


1. Server-Side Request Forgery

This vulnerability can be exploited by an attacker with a registered account

as low as a normal account. If the server which is hosting the web application

disallows cURL functions, the application will use the "fsockopen" function as an

alternative. Below is the example on how the SSRF issue can be exploited.


URL : http:// $DOMAIN/usercp.php


PAYLOAD : avatarurl=http://$IP:$PORT:80



Vulnerable / tested versions:


MyBB version 1.8.10 has been tested. This version was the latest version

at the time the security vulnerability was discovered.



Vendor contact timeline:


2017-03-09: Contacting vendor through the "Private Inquiries" forum at

2017-03-09: Advisory sent through the "Private Inquiries". Vendor has

confirmed the issues. No specific date on the fix was given

2017-03-17: Vendor confirmed the vulnerability; working on the fix

2017-03-31: Requesting a status update.

2017-04-04: Patch released by the vendor.

2017-04-07: Public release of advisory.





Upgrade to MyBB 1.8.11


For further information see:








Advisory URL:






SEC Consult Vulnerability Lab


SEC Consult

Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow

Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich


About SEC Consult Vulnerability Lab

The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It

ensures the continued knowledge gain of SEC Consult in the field of network

and application security to stay ahead of the attacker. The SEC Consult

Vulnerability Lab supports high-quality penetration testing and the evaluation

of new offensive and defensive technologies for our customers. Hence our

customers obtain the most current information about vulnerabilities and valid

recommendation about the risk profile of new technologies.



Interested to work with the experts of SEC Consult?

Send us your application


Interested in improving your cyber security with the experts of SEC Consult?

Contact our local offices



Mail: research at sec-consult dot com





EOF Fikri Fadzil / @2017