A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:
Impact - The entire activity stream becomes unviewable (UI fails to render). - New notes cannot be displayed, effectively breaking all future collaboration on the issue.
Patches Fixed in 2.27.2.
Workarounds None
Credits Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.
Due to an incorrect use of loose (==) instead of strict (===) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.
[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authenticationapi.php#L782
Impact On MantisBT instances configured to use the MD5 login method, user accounts having a password hash evaluating to zero (i.e. matching regex ^0+[Ee][0-9]+$) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a hash evaluating to zero, for example comito5 (0e579603064547166083907005281618).
No password bruteforcing for individual users is needed, thus $gmaxfailedlogincount does not protect against the attack.
Patches https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2
Workarounds Check the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL: sql SELECT username, email FROM mantisusertable WHERE password REGEXP '^0+[Ee][0-9]+$'
References - https://mantisbt.org/bugs/view.php?id=35967
Credits Thanks to Harry Sintonen / Reversec for discovering and reporting the issue.
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2.
Impact
Due to insufficient access-level checks, any non-admin user having access to manageconfigcolumnspage.php (typically project managers having MANAGER role) can use the Copy From action to retrieve the columns configuration from a private project they have no access to.
Access to the reverse operation (Copy To) is correctly controlled, i.e. it is not possible to alter the private project's configuration.
Patches The vulnerability will be fixed in MantisBT version 2.27.2.
Workarounds None
Credits Thanks to d3vpoo1 for reporting the issue.
Improper escaping of tag names retrieved from History in Timeline (myviewpage.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.
Impact Cross-site scripting (XSS).
Patches f32787c14d4518476fe7f05f992dbfe6eaccd815
Workarounds Edit offending History entries (using SQL) Wrap $this->tagname in a stringhtmlspecialchars() call in IssueTagTimelineEvent::html()
Credits MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.
Improper escaping of Tag name when deleting it in tagdelete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.
Impact Cross-site scripting (XSS).
Patches 80990f43153167c73f11eb4b2bc7108d0c3d6b46
Workarounds Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9 Manually edit language files to remove the sprintf placeholder %1$s from $stagdeletemessage string, for example with sed -r -i '/tagdeletemessage/s/.%1\$s.//' -- lang/
Credits MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.
Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when: - resolving or closing issues (bugchangestatuspage.php) belonging to a project linking said custom field - viewing issues (viewallbugpage.php) when the custom field is displayed as a column - printing issues (printallbugpage.php) when the custom field is displayed as a column
Impact Cross-site scripting (XSS).
Patches https://github.com/mantisbt/mantisbt/commit/447a521aae0f82f791b8116a14a20e276df739be
Workarounds Ensure Custom Field Names do not contain HTML tags.
References - https://mantisbt.org/bugs/view.php?id=34432 - This is related to CVE-2020-25830 (same root cause, different affected pages)
If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip.
Impact Disclosure of the following information: - existence of the note - note author name - note creation timestamp - issue id the note belongs to
Patches See PR https://github.com/mantisbt/mantisbt/pull/2000
Workarounds None
References https://mantisbt.org/bugs/view.php?id=34434
Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending.
The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password.
A brute-force attack calling accountupdate.php with increasing user IDs is possible. Impact
A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to.
Patches
92d11a01b195a1b6717a2f205218089158ea6d00
Workarounds
Mitigate the risk by reducing the verification token's validity (change the value of the TOKENEXPIRYAUTHENTICATED constant in constantsinc.php).
References
https://mantisbt.org/bugs/view.php?id=34433
Credits
Alexander Christian, from Vantage Point Security Indonesia
Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message.
Patches https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744
Workarounds Define $gpath as appropriate in configinc.php.
References https://mantisbt.org/bugs/view.php?id=19381
Credits
Thanks to the following security researchers for responsibly reporting and helping resolve this vulnerability.
- Pier-Luc Maltais (https://twitter.com/plmaltais) - Hlib Yavorskyi (https://github.com/Kerkroups) - Jingshao Chen (https://github.com/shaozi) - Brandon Roldan - nhchoudhary
Impact
Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs.
Patches Patch under development. The vulnerability will be fixed in MantisBT version 2.25.8.
Workarounds Disable wiki integration ( $gwikienable = OFF;)
References - https://mantisbt.org/bugs/view.php?id=32981
An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.
An XSS issue was discovered in browsersearchplugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in managepluginpage.php and managepluginuninstall.php when a crafted plugin is installed.
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csvexport.php generated CSV file in Excel.
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bugrevisionviewpage.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnoteid parameter.
An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.
An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr[]= in a crafted bugactiongrouppage.php URL. (The target Issues can have Private view status, or belong to a private Project.)
In manageprojeditpage.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manageprojeditpage.php projectid parameter, without having access to them.
An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue (i.e., one having Private view status, or belonging to a private Project) via the bugarr[] parameter. This provides full access to potentially confidential information.
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mcprojectgetusers function through the API SOAP.
An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bugactiongrouppage.php.
An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on viewallbugpage.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
MantisBT XSS when uploading an attachment