CVE-2019-9889

Vulnerability

The getSingleIndex function in the AddonManager class of Vanilla (before version 2.6.4) does not validate the type parameter, allowing a crafted value to be passed to a require call. This results in directory traversal combined with file inclusion. The vulnerability exists in versions prior to 2.6.4 [1][2].

Exploitation

An attacker must have the ability to supply a type value to the AddonManager, likely through a web request that triggers the vulnerable code path. No authentication is required if the endpoint is publicly accessible. By providing a path traversal sequence (e.g., ../../) in the type parameter, the attacker can include arbitrary PHP files from the server's filesystem.

Impact

Successful exploitation allows the attacker to include and execute arbitrary PHP files under the context of the web server. This can lead to remote code execution, full compromise of the application, and potential lateral movement within the hosting environment.

Mitigation

The fix was implemented in Vanilla version 2.6.4, released on October 29, 2018 [1][2]. The patch enforces allowed add-on types and keys, preventing arbitrary input from reaching the require call. Users should upgrade to 2.6.4 or later. No known workarounds are documented.