CVE-2022-24734: MyBB Forum Software RCE Vulnerability

CVE-2022-24734 Overview

CVE-2022-24734 is a Remote Code Execution (RCE) vulnerability affecting MyBB, a free and open source forum software. The vulnerability exists in the Admin Control Panel's Settings management module, which fails to properly validate setting types on insertion and update operations. This flaw allows authenticated administrators with the "Can manage settings?" permission to inject and execute arbitrary PHP code through the settings interface.

Critical Impact

Authenticated administrators can leverage insufficient input validation in the Settings module to inject PHP code that executes when visiting Change Settings pages, leading to complete server compromise.

Affected Products

• MyBB versions prior to 1.8.30
• MyBB installations with Admin CP enabled
• Systems where administrators have "Can manage settings?" permissions

Discovery Timeline

• 2022-03-09 - CVE-2022-24734 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24734

Vulnerability Analysis

The vulnerability stems from improper input validation in MyBB's Admin Control Panel Settings management module. MyBB's Settings module allows administrators to add, edit, and delete non-default settings, storing setting data in an options code string ($options_code) within the mybb_settings.optionscode database column. This column identifies the setting type and its options, separated by a newline character (\n).

Since MyBB version 1.2.0, support for the php setting type was introduced, where the remaining portion of the options code is interpreted and executed as PHP code on Change Settings pages. This feature was originally reserved for plugins and internal use but lacked sufficient validation to prevent abuse.

The vulnerable code attempts to filter out php type settings but does so inadequately by only checking if the first three characters match "php" (case-insensitive) after removing newline characters. An attacker could bypass this check using various techniques, enabling the injection of arbitrary PHP code.

Root Cause

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The Settings management module in admin/modules/config/settings.php fails to properly validate the type input parameter. The original validation only stripped newline characters and performed a simple prefix check against "php", which could be circumvented through character encoding or other bypass techniques.

Attack Vector

The attack requires network access with authenticated administrator privileges having the "Can manage settings?" permission. Once authenticated, an attacker can:

1. Navigate to the Admin CP Settings management interface
2. Create or modify a setting with a malicious type value that bypasses the inadequate filter
3. Inject PHP code into the optionscode field
4. Trigger code execution when visiting the Change Settings page

The following patch demonstrates how MyBB addressed the vulnerability:

 		}
 
 		// do some type filtering
-		$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']);
-		if(strtolower(substr($mybb->input['type'], 0, 3)) == "php")
+		$mybb->input['type'] = $mybb->get_input('type');
+		if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php")
 		{
 			$mybb->input['type'] = "";
 		}

Source: GitHub MyBB Commit

The fix implements stricter validation by requiring the type to be alphanumeric only (ctype_alnum) and explicitly blocking the "php" type through an exact case-insensitive match.

Detection Methods for CVE-2022-24734

Indicators of Compromise

• Unusual entries in the mybb_settings database table with optionscode values containing PHP code
• New or modified settings created by administrator accounts with suspicious timing
• Unexpected PHP execution or web shells appearing on the server
• Anomalous Admin CP access patterns, particularly to the Settings management module

Detection Strategies

• Monitor Admin CP access logs for unusual activity in the Settings management module (/admin/index.php?module=config-settings)
• Implement database auditing to detect modifications to the mybb_settings table
• Review Admin CP audit logs for setting creation or modification events
• Deploy web application firewalls (WAF) with rules to detect PHP code in form submissions to Admin CP endpoints

Monitoring Recommendations

• Enable detailed logging for all Admin CP activities
• Configure alerts for new setting creation or modification events
• Monitor for unauthorized administrator account creation or privilege changes
• Implement file integrity monitoring on MyBB installation directories

How to Mitigate CVE-2022-24734

Immediate Actions Required

• Upgrade to MyBB version 1.8.30 or later immediately
• Review existing administrator accounts and remove unnecessary "Can manage settings?" permissions
• Audit the mybb_settings database table for any suspicious entries containing PHP code
• Review Admin CP access logs for signs of exploitation

Patch Information

MyBB has released version 1.8.30 which resolves this vulnerability. The patch implements proper input validation by requiring setting types to contain only alphanumeric characters and explicitly blocking the php type. The security fix is documented in the GitHub Security Advisory GHSA-876v and the MyBB Version 1.8.30 Release Notes. Additional technical details are available in the Zero Day Initiative Advisory ZDI-22-503.

Workarounds

• There are no known workarounds for this vulnerability according to the official advisory
• Restrict Admin CP access to trusted IP addresses only as a defense-in-depth measure
• Remove "Can manage settings?" permission from all non-essential administrator accounts
• Consider temporarily disabling Admin CP access until the patch can be applied

# Configuration example - Restrict Admin CP access by IP in .htaccess
<Files "admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>