CVE-2011-10018
📋 TL;DR
CVE-2011-10018 is a critical backdoor vulnerability in myBB 1.6.4 that allows unauthenticated remote attackers to execute arbitrary PHP code via manipulated cookies. This results in complete compromise of the web server running the vulnerable myBB installation. All users running myBB 1.6.4 are affected.
💻 Affected Systems
- myBB
📦 What is this software?
Mybb by Mybb
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining full control over the web server, allowing data theft, malware deployment, and use as a pivot point for further network attacks.
Likely Case
Remote code execution leading to website defacement, data exfiltration, and installation of persistent backdoors or cryptocurrency miners.
If Mitigated
No impact if the vulnerable version is not deployed or if proper network segmentation and web application firewalls block the exploit.
🎯 Exploit Status
Metasploit module available, simple cookie manipulation required. The backdoor was intentionally inserted during packaging.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.6.5 or re-download 1.6.4 after October 6, 2011
Vendor Advisory: https://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit/
Restart Required: No
Instructions:
1. Immediately upgrade to myBB 1.6.5 or later. 2. If staying on 1.6.4, re-download from official source after October 6, 2011. 3. Replace all myBB files with clean version. 4. Verify no backdoor files remain.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests containing the malicious cookie pattern used in exploitation
File Integrity Monitoring
linuxMonitor for unauthorized PHP file modifications in myBB directories
find /path/to/mybb -name "*.php" -exec md5sum {} \; > baseline.md5
md5sum -c baseline.md5 2>/dev/null | grep -v OK
🧯 If You Can't Patch
- Immediately take the affected system offline until it can be patched
- Implement strict network segmentation to isolate the vulnerable system from critical assets
🔍 How to Verify
Check if Vulnerable:
Check if running myBB 1.6.4 and verify file hashes against known clean versions. Look for suspicious code in inc/class_core.php around line 284.Check Version:
grep -i 'mybb version' inc/init.php | head -1Verify Fix Applied:
Verify version is 1.6.5 or later, and check that inc/class_core.php does not contain the backdoor code (eval base64_decode).📡 Detection & Monitoring
Log Indicators:
- Unusual cookie values in web logs, particularly with base64 encoded content
- Unexpected PHP file creation or modification in myBB directories
- Suspicious eval() function calls in application logs
Network Indicators:
- HTTP requests with manipulated 'collapsed' cookie parameter
- Outbound connections from web server to unknown IPs
SIEM Query:
web_access_logs WHERE uri CONTAINS 'index.php' AND cookie CONTAINS 'collapsed' AND cookie MATCHES '.*[A-Za-z0-9+/]{50,}=*.*'🔗 References
- https://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit/
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/mybb_backdoor.rb
- https://web.archive.org/web/20111015224948/http://secunia.com/advisories/46300/
- https://www.exploit-db.com/exploits/17949
- https://www.vulncheck.com/advisories/mybb-backdoor-arbitrary-command-execution
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/mybb_backdoor.rb
- https://www.exploit-db.com/exploits/17949
