Date: Sun, 04 Sep 2011 16:05:20 +1000 From: David Hicks <d@...id.au> To: oss-security@...ts.openwall.com Subject: Re: CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS) On Sun, 2011-09-04 at 15:18 +1000, David Hicks wrote: > Request #2: LFI and XSS via bug_actiongroup_ext_page.php I don't think my earlier message conveyed the severity of this bug well enough. MantisBT allows users to upload attachments to bug reports. These attachments are commonly stored on the disk in an 'attachments' directory that should be stored outside the web root (but are still accessible to MantisBT for retrieval). This LFI vulnerbility therefore allows arbitrary remote code execution on a target server (as the web user ID). This level of access could be used to connect to the MantisBT database and access files and configuration of other web applications operating under the same uid/gid as the MantisBT installation. For example, this LFI vulnerability may allow an attacker to call: require_once('../var/www/example.com/data/mantisbt/attachments/123456-malicious_attachment.php') Note that as per the earlier notice, some users (such as those using nginx) may not be impacted at all. release-1.2.8 has been tagged at https://github.com/mantisbt/mantisbt/tree/release-1.2.8 and should be packaged and distributed via usual channels shortly. Distributors and users are advised not to wait - patch ASAP or put workarounds in place such as disallowing attachment uploads ($g_allow_file_upload = OFF in config_inc.php) if you're using $g_file_upload_method = DISK. Thanks, David Hicks MantisBT Developer mantisbt.org, #mantishelp irc.freenode.net [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ