CVE-2024-23830: MantisBT Host Header Injection vulnerability
Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message.
Patches https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744
Workarounds Define $gpath as appropriate in configinc.php.
References https://mantisbt.org/bugs/view.php?id=19381
Credits
Thanks to the following security researchers for responsibly reporting and helping resolve this vulnerability.
- Pier-Luc Maltais (https://twitter.com/plmaltais) - Hlib Yavorskyi (https://github.com/Kerkroups) - Jingshao Chen (https://github.com/shaozi) - Brandon Roldan - nhchoudhary
Other sources
MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's account by poisoning the link in the password reset notification message. A patch is available in version 2.26.1. As a workaround, define $gpath as appropriate in configinc.php.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mantisbt/mantisbtto a version that resolves this vulnerability.Fixed in 2.26.1 - Upgrade
Upgrade
MantisBTto a version that resolves this vulnerability.Fixed in 2.26.1 - Configuration
As a workaround (when not yet upgraded), define `$g_path` as appropriate in `config_inc.php`.
MantisBT $g_path (in config_inc.php) = define $g_path as appropriate in config_inc.php
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23830?
CVE-2024-23830 is considered to be a high severity vulnerability due to the potential for account hijacking.
How do I fix CVE-2024-23830?
To fix CVE-2024-23830, upgrade to MantisBT version 2.26.1 or later.
What types of attacks are possible with CVE-2024-23830?
An attacker can perform account hijacking by exploiting the password reset process.
Who is affected by CVE-2024-23830?
Users of MantisBT versions prior to 2.26.1 are affected by this vulnerability.
Is CVE-2024-23830 a remote or local vulnerability?
CVE-2024-23830 is a remote vulnerability, as it can be exploited by unauthenticated attackers.