CVE-2024-23336: Incomplete disallowed remote addresses list in MyBB
First published: Wed May 01 2024(Updated: )
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MyBB | <1.8.38 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23336?
CVE-2024-23336 is classified as a server-side request forgery (SSRF) vulnerability with potentially high impact.
How do I fix CVE-2024-23336?
To fix CVE-2024-23336, update your MyBB installation to a version later than 1.8.38 and review the disallowed remote addresses in the configuration file.
What versions of MyBB are affected by CVE-2024-23336?
CVE-2024-23336 affects MyBB versions up to and including 1.8.38.
What can attackers do exploiting CVE-2024-23336?
Attackers exploiting CVE-2024-23336 can perform unauthorized internal network requests via SSRF leading to data exposure or server compromise.
Is it safe to use MyBB without mitigation for CVE-2024-23336?
Using MyBB without mitigation for CVE-2024-23336 poses a significant risk, as it allows potential SSRF attacks.
- agent/title
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/mybb
- canonical/mybb