MantisBT allows cross-site scripting (XSS) via crafted filename

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

Due to an incorrect use of loose (==) instead of strict (===) comparison in the [authentication code][1], PHP type juggling will cause interpretation of certain MD5 hashes as numbers, specifically those matching scientific notation.

[1]: https://github.com/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authenticationapi.php#L782

Impact On MantisBT instances configured to use the MD5 login method, user accounts having a password hash evaluating to zero (i.e. matching regex ^0+[Ee][0-9]+$) are vulnerable, allowing an attacker knowing the victim's username to login without knowledge of their actual password, using any other password having a hash evaluating to zero, for example comito5 (0e579603064547166083907005281618).

No password bruteforcing for individual users is needed, thus $gmaxfailedlogincount does not protect against the attack.

Patches https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2

Workarounds Check the database for vulnerable accounts, and change those users' passwords, e.g. for MySQL: sql SELECT username, email FROM mantisusertable WHERE password REGEXP '^0+[Ee][0-9]+$'

References - https://mantisbt.org/bugs/view.php?id=35967

Credits Thanks to Harry Sintonen / Reversec for discovering and reporting the issue.

MantisBT allows arbitrary password reset

Improper escaping of Tag name when deleting it in tagdelete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.

Impact Cross-site scripting (XSS).

Patches 80990f43153167c73f11eb4b2bc7108d0c3d6b46

Workarounds Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9 Manually edit language files to remove the sprintf placeholder %1$s from $stagdeletemessage string, for example with sed -r -i '/tagdeletemessage/s/.%1\$s.//' -- lang/

Credits MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.

Improper escaping of tag names retrieved from History in Timeline (myviewpage.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.

Impact Cross-site scripting (XSS).

Patches f32787c14d4518476fe7f05f992dbfe6eaccd815

Workarounds Edit offending History entries (using SQL) Wrap $this->tagname in a stringhtmlspecialchars() call in IssueTagTimelineEvent::html()

Credits MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

Impact Knowing a user's email address and username, an unauthenticated attacker can hijack the user's account by poisoning the link in the password reset notification message.

Patches https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744

Workarounds Define $gpath as appropriate in configinc.php.

References https://mantisbt.org/bugs/view.php?id=19381

Credits

Thanks to the following security researchers for responsibly reporting and helping resolve this vulnerability.

- Pier-Luc Maltais (https://twitter.com/plmaltais) - Hlib Yavorskyi (https://github.com/Kerkroups) - Jingshao Chen (https://github.com/shaozi) - Brandon Roldan - nhchoudhary

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csvexport.php generated CSV file in Excel.

A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:

Impact - The entire activity stream becomes unviewable (UI fails to render). - New notes cannot be displayed, effectively breaking all future collaboration on the issue.

Patches Fixed in 2.27.2.

Workarounds None

Credits Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.

The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.

Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mcprojectgetattachments function in api/soap/mcprojectapi.php; the (2) newsgetlimitedrows function in core/newsapi.php; the (3) summaryprintbyenum, (4) summaryprintbyage, (5) summaryprintbydeveloper, (6) summaryprintbyreporter, or (7) summaryprintbycategory function in core/summaryapi.php; the (8) createbugenumsummary or (9) enumbuggroup function in plugins/MantisGraph/core/graphapi.php; (10) buggraphbycategory.php or (11) buggraphbystatus.php in plugins/MantisGraph/pages/; or (12) projdocpage.php, related to use of the dbquery function, a different vulnerability than CVE-2014-1608.

SQL injection issues were discovered in MantisBT, an open source issue tracker.

CVE-2014-1608 patch: https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102

CVE-2014-1609 patch: https://github.com/mantisbt/mantisbt/commit/7efe0175f0853e18ebfacedfd2374c4179028b3f

It was reported that versions 1.1.0a4 to 1.2.15 are affected.

References: http://www.ocert.org/advisories/ocert-2014-001.html

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the pregreplace function with the e modifier.

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bugrevisionviewpage.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnoteid parameter.

CAPTCHA bypass vulnerability in MantisBT before 1.2.19.

Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending.

The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password.

A brute-force attack calling accountupdate.php with increasing user IDs is possible. Impact

A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to.

Patches

92d11a01b195a1b6717a2f205218089158ea6d00

Workarounds

Mitigate the risk by reducing the verification token's validity (change the value of the TOKENEXPIRYAUTHENTICATED constant in constantsinc.php).

References

https://mantisbt.org/bugs/view.php?id=34433

Credits

Alexander Christian, from Vantage Point Security Indonesia

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.

Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when: - resolving or closing issues (bugchangestatuspage.php) belonging to a project linking said custom field - viewing issues (viewallbugpage.php) when the custom field is displayed as a column - printing issues (printallbugpage.php) when the custom field is displayed as a column

Impact Cross-site scripting (XSS).

Patches https://github.com/mantisbt/mantisbt/commit/447a521aae0f82f791b8116a14a20e276df739be

Workarounds Ensure Custom Field Names do not contain HTML tags.

References - https://mantisbt.org/bugs/view.php?id=34432 - This is related to CVE-2020-25830 (same root cause, different affected pages)

SQL injection vulnerability in the manage configuration page (admconfigreport.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filterconfigid parameter.

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue (i.e., one having Private view status, or belonging to a private Project) via the bugarr[] parameter. This provides full access to potentially confidential information.

MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in stringapi.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a permalinkpage.php?url= URI and (2) an open redirect via a loginpage.php?return= URI.

In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mcprojectgetusers function through the API SOAP.

Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php.

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.

The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $fdatabase, $fdbusername, and $fadminusername variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.