Appendix
Security
Issues with no security advisories
2002-01 SQL poisoning vulnerability in Mantis
2002-02 Limiting output to reporters can be bypassed
2002-04 Arbitrary code execution vulnerability in Mantis
2002-05 Arbitrary code execution and file reading
2002-06 Private bugs accessible in Mantis
2002-07 Bugs in private projects listed on 'View Bugs'
2004-01 Various vulnerabilities in Mantis
Partner Links
|
2002-03 Bug listings of private projects can be viewed Last Modified: December 23, 2006 04:12AM |
| (Up to version 0.17.3) |
|
Description
0. Table of Contents 1. Introduction 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution 5. Detailed explanation 6. Contact details 1. Introduction Mantis is an Open Source web-based bugtracking system, written in PHP, which uses the MySQL database server. It is being actively developed by a small group of developers, and is considered to be in the beta stage. 2. Summary / Impact analysis In Mantis a user can select a project from a drop-down menu. After selection, all bug listings will be limited to that project. The 'View Bugs' page, which is responsible for displaying a list of bugs in a project, did not check whether the user actually had access to the project defined in the cookie. It trusted the fact that only projects accessible to the user were listed in the drop-down menu. This provides a malicious user with an opportunity to display the 'View Bugs' page with a private project selected. This has been fixed in Mantis 0.17.4. It should be noted that this bug does not allow a user to get any more information than is listed in the View Bugs page. The page with more information about the bug is not accessible. Also, private bugs are still not visible in the list. 3. Affected versions The following versions are known to be affected: Mantis 0.17.3 The following versions are known to be unaffected: Mantis 0.17.4a Mantis 0.17.4 The following versions are presumed to be affected: Any version below Mantis 0.17.3 4. Workaround / Solution Mantis 0.17.4 adds the appropriate permission checks to the 'View Bugs' page. All users are recommended to upgrade to this version as soon as possible. If an upgrade is not an option, view_all_bug_page.php can be patched to add the appropriate checks. To do so, add the following function to core_user_API.php:
# Check to see if the current user has access on the specified project
function check_access_to_project( $p_project_id ) {
$t_project_view_state = get_project_field( $p_project_id, 'view_state');
# Administrators ALWAYS pass.
if ( get_current_user_field( 'access_level' ) >= ADMINISTRATOR ) {
return;
}
# public project accept all users
if ( PUBLIC == $t_project_view_state ) {
return;
} else {
# private projects require users to be assigned
$t_project_access_level = get_project_access_level( $p_project_id );
# -1 means not assigned, kick them out to the project selection screen
if ( -1 == $t_project_access_level ) {
print_header_redirect( 'login_select_proj_page.php' );
} else { # passed
return;
}
}
}
And in view_all_bug_page.php, replace the following lines:
$t_where_clause .= ')';
}
} else {
$t_where_clause = " WHERE project_id='$g_project_cookie_val'";
}
# end project selection
with the following lines:
$t_where_clause .= ')';
}
} else {
check_access_to_project($g_project_cookie_val);
$t_where_clause = " WHERE project_id='$g_project_cookie_val'";
}
# end project selection
5. Proof of Vulnerability To take advantage of this vulnerability, the attacker would need to know the project_id of the private project he wishes to attack. This is not terribly difficult to accomplish, as the project_id starts at 1 and increases by one for every project created. The attacker can just try each integer starting at 1, until (s)he finds the one (s)he's looking for. The next step is to log in to Mantis at least once, so that the MANTIS_PROJECT_COOKIE, or however the cookie is called in that particular set-up, is set. The user can then manually change the cookie locally, and fill in the desired project_id. Now all the user has to do is visit /view_all_bug_page.php, and the list of public bugs in that project should be displayed. An alternative method is by forging the HTTP headers, to send the desired cookie value with a request for /view_all_bug_page.php. The results are the same. 6. Contact details The latest version of Mantis is always available from: http://www.mantisbt.org/ The current version is 1.0.6, which can be downloaded from http://www.mantisbt.org/download.php If you have any questions about this vulnerability, or wish to report another, you can contact report it as a private issue on: http://www.mantisbt.org/bugs/ The latest version of this and other advisories can be found at: http://www.mantisbt.org/manual/ |
| User Contributed Notes 2002-03 Bug listings of private projects can be viewed |
|
||
| There are no user contributed notes for this page. | |||
| |||