Register Members List Search Today's Posts Mark Forums Read

Reply
 
Mod Options
Patched Flash Uploader to Fix Known Exploits Details »
Patched Flash Uploader to Fix Known Exploits
Mod Version: 2.00, by alexm (Coder) alexm is offline
Developer Last Online: Jun 2021 I like it Show Printable Version Email this Page

vB Version: 4.x.x Rating: (33 votes - 4.88 average) Installs: 204
Released: 14 Jan 2014 Last Update: Never Downloads: 845
Supported Code Changes Additional Files  

UPDATE Dec 2014: 4.2.2 PL2, 4.2.2 PL3 and 4.2.3 core download packages from vBulletin now include this patched version of uploader.swf as standard.

This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads.

An exploit was found in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated.

vBulletin's recommended fix is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications.

This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin.

The YUI source used is provided freely by Yahoo to whom I give full credit.


1) Installation

a) Extract uploader.swf from the .zip file and replace your existing file here:

<forum_root>/clientscript/yui/uploader/assets/uploader.swf

b) Make sure the flash uploader is enabled in the Admin Control Panel

Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default"

c) Make sure you are NOT using remote YUI

vBulletin Options -> Server Settings and Optimization Options

Use Remote YUI set to None

d) You may also need to clear your browser cache and/or vBulletin cache (Maintenance ->Clear system cache) if you have performed the above steps correctly but clicking the Upload button still does nothing.



2) Changes

11th January 2014

The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string.


11th January 2014 v2

Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions
  • finding another exploit (using another parameter). Exploit fixed by setting the parameter (not used by vBulletin) to null.
  • '-' Character added to allowed characters in allowedDomain


Non-Flash Alternative
Please note that if you would rather avoid using flash altogether an alternative Mod has been released by BirdOPrey5, although there are some compromises/limitations with IE10+.

Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader


DISCLAIMER
I am not a flash developer, I am just another vBulletin customer trying to keep his members happy!
This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk!


Copyright © 2013 Yahoo! Inc. All rights reserved.
Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Download Now

Only licensed members can download files, Click Here for more information.

Show Your Support

  • To receive notifications regarding updates -> Click to Mark as Installed.
  • This modification may not be copied, reproduced or published elsewhere without author's permission.
  #31  
Old 04 Feb 2014, 08:27
bombardier bombardier is offline
 
Join Date: Jan 2006
Well I cant say I fully understood what the issue was only that there was one.
I have installed this fix and have experienced no noticeable change or issues.

whatever the problem was it is fixed and I thank you very very much for your efforts.
Reply With Quote
  #32  
Old 10 Feb 2014, 17:03
GONUMBER6's Avatar
GONUMBER6 GONUMBER6 is offline
 
Join Date: Jan 2010
Real name: Lisa
Thanks!!!!!
Reply With Quote
  #33  
Old 10 Feb 2014, 17:08
DemOnstar's Avatar
DemOnstar DemOnstar is offline
 
Join Date: Dec 2012
MOD of the month this month surely....

Well done in advance alexm.....

Voted!
Reply With Quote
  #34  
Old 10 Feb 2014, 23:08
dougdirac's Avatar
dougdirac dougdirac is offline
 
Join Date: Nov 2011
Kinda sad that basic maintenance ends up being so praiseworthy. We've long giving up on features or improvements.
Reply With Quote
  #35  
Old 17 Feb 2014, 17:38
Boulard83 Boulard83 is offline
 
Join Date: Mar 2010
MUCH MUCH appreciated, big +1
Reply With Quote
  #36  
Old 19 Feb 2014, 00:22
Silver_2000_)! Silver_2000_)! is offline
 
Join Date: Mar 2002
Uploaded the file and the button still doesnt work - im sure I missed some step ...
Reply With Quote
  #37  
Old 19 Feb 2014, 01:32
naveeid's Avatar
naveeid naveeid is offline
 
Join Date: Jan 2011
This is great , i was looking for this solution , the response from Vbulletin official team on this issue was hopeless ,

but alexm you have taken the right step , great work. thanks.
__________________
------------------

Nidokidos Official forum
Reply With Quote
  #38  
Old 24 Feb 2014, 19:53
XiTCLUB XiTCLUB is offline
 
Join Date: Jan 2010
Real name: Mian Shahzad Raza
Thanks for this big help !!
Reply With Quote
  #39  
Old 01 Mar 2014, 12:23
tom w tom w is offline
 
Join Date: Feb 2006
Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.
Reply With Quote
  #40  
Old 02 Mar 2014, 08:48
hoangserip's Avatar
hoangserip hoangserip is offline
 
Join Date: Jun 2009
Thanks for the Patch.
Reply With Quote
  #41  
Old 02 Mar 2014, 11:07
alexm's Avatar
alexm alexm is offline
 
Join Date: Apr 2005
Originally Posted by tom w View Post
Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.
I would be happy to share the source with another developer if their suggestions/feedback helps the community as a whole, but how would you know if I've given you the correct source? And, also being a paranoid security type with a busy vB4 forum myself, how do I know you aren't looking for vulnerabilities to exploit yourself?

I think the easy answer is if you understand Flash it's very easy to decompile the SWF yourself and look at the source. That's basically what I did to get it working anyway.

If anyone does find an issue let me know and I'll do my best to incorporate a fix.
Reply With Quote
  #42  
Old 02 Mar 2014, 13:40
BirdOPrey5's Avatar
BirdOPrey5 BirdOPrey5 is offline
 
Join Date: Jun 2008
Real name: Joe D.
Originally Posted by tom w View Post
Being a paranoid security type, any chance of getting the source code for this replacement file? Since it doesn't come from either Yahoo or VBulletin (for whatever reason) I'm reluctant to trust files from a relatively unknown sources (though it's great people like to help) which could introduce other vulnerabilities that we'd never know about.
FYI

There are many free flash / swf file decompilers online you can upload the .swf file and get the source yourself.

For example - http://www.showmycode.com
__________________
-Joe
Former vb.org Moderator. Retired.

@BirdOPrey5 | All Things BOP5 | Joe's Ultimate Off Topic
Note - I no longer making new VB mods, sorry.
Reply With Quote
  #43  
Old 10 Mar 2014, 04:34
furnival furnival is offline
 
Join Date: Mar 2008
I belatedly upgraded to VB 4.22 and had to reinstall this afterwards. This should be incorporated into the next VB 4 release so that everyone doesn't have to reinstall this once more.
Reply With Quote
  #44  
Old 12 Mar 2014, 04:50
msnhockey msnhockey is offline
 
Join Date: Jul 2008
I cant seem to get this to select more than 1 image in IE or Chrome with the settings in the instructions and with deleting browser cache. any ideas?

I am using IE 11 and Chrome version 33.0.1750.146
Reply With Quote
  #45  
Old 12 Mar 2014, 09:20
Zachery's Avatar
Zachery Zachery is offline
 
Join Date: Jul 2002
Real name: Zachery Woods
Originally Posted by furnival View Post
I belatedly upgraded to VB 4.22 and had to reinstall this afterwards. This should be incorporated into the next VB 4 release so that everyone doesn't have to reinstall this once more.
there are no plans to add the flash uploader back, in any form, at this time.
__________________
Looking for ImpEx?
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Mod Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 20:58.

Layout Options | Width: Wide Color: