CVE-2024-23336: Incomplete disallowed remote addresses list in MyBB
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the 127.0.0.0/8 block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's Disallowed Remote Addresses list ($config['disallowedremoteaddresses']) contains the address 127.0.0.1, but does not include the complete block 127.0.0.0/8. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (inc/config.php) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23336?
CVE-2024-23336 is classified as a server-side request forgery (SSRF) vulnerability with potentially high impact.
How do I fix CVE-2024-23336?
To fix CVE-2024-23336, update your MyBB installation to a version later than 1.8.38 and review the disallowed remote addresses in the configuration file.
What versions of MyBB are affected by CVE-2024-23336?
CVE-2024-23336 affects MyBB versions up to and including 1.8.38.
What can attackers do exploiting CVE-2024-23336?
Attackers exploiting CVE-2024-23336 can perform unauthorized internal network requests via SSRF leading to data exposure or server compromise.
Is it safe to use MyBB without mitigation for CVE-2024-23336?
Using MyBB without mitigation for CVE-2024-23336 poses a significant risk, as it allows potential SSRF attacks.