CVE-2023-46251
📋 TL;DR
This DOM-based XSS vulnerability in MyBB forum software allows attackers to execute malicious JavaScript in victims' browsers by tricking them into viewing specially crafted MyCode messages in the visual editor. It affects MyBB installations with the visual editor enabled, potentially compromising user accounts and session data. The vulnerability requires user interaction but can be exploited through malicious links or pre-filled content.
💻 Affected Systems
- MyBB
📦 What is this software?
Mybb by Mybb
⚠️ Risk & Real-World Impact
Worst Case
Attackers can steal session cookies, perform actions as authenticated users, deface forums, or redirect users to malicious sites, potentially leading to full account compromise.
Likely Case
Session hijacking, account takeover, or defacement of forum content through injected scripts.
If Mitigated
No impact if visual editor is disabled or proper input sanitization is implemented.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link or viewing pre-filled content) and the visual editor to be active. Attackers need to craft malicious MyCode messages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.37
Vendor Advisory: https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8
Restart Required: No
Instructions:
1. Download MyBB 1.8.37 from mybb.com. 2. Backup your current installation. 3. Replace files with new version. 4. Run upgrade script if needed. 5. Verify visual editor still works as expected.
🔧 Temporary Workarounds
Disable Visual Editor Globally
allTurn off the Clickable MyCode Editor in admin settings to prevent exploitation.
Disable Visual Editor Per User
allUsers can disable 'Show the MyCode formatting options on the posting pages' in their profile settings.
🧯 If You Can't Patch
- Disable the visual editor globally in Admin CP → Configuration → Settings → Clickable Smilies and BB Code
- Educate users to disable visual editor in User CP → Your Profile → Edit Options
🔍 How to Verify
Check if Vulnerable:
Check if MyBB version is below 1.8.37 and visual editor is enabled in settings.Check Version:
Check inc/config.php for $config['version'] or view footer on admin pagesVerify Fix Applied:
Verify installation is version 1.8.37 or higher, and test that MyCode input is properly escaped in visual editor.📡 Detection & Monitoring
Log Indicators:
- Unusual MyCode patterns in posts/PMs
- Multiple failed login attempts from same IP after suspicious posts
Network Indicators:
- Requests containing malicious script patterns in GET/POST parameters
SIEM Query:
Search for patterns like '<script>' or 'javascript:' in forum post content or URL parameters🔗 References
- https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276
- https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8
- https://mybb.com/versions/1.8.37/
- https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276
- https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8
- https://mybb.com/versions/1.8.37/
