oss-security - Re: CVE requests: <mantisbt-1.2.8 multiple vulnerabilities (1xLFI+XSS, 2xXSS)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 04 Sep 2011 16:05:20 +1000
From: David Hicks <d@...id.au>
To: oss-security@...ts.openwall.com
Subject: Re: CVE requests: <mantisbt-1.2.8 multiple
 vulnerabilities (1xLFI+XSS, 2xXSS)

On Sun, 2011-09-04 at 15:18 +1000, David Hicks wrote:
> Request #2: LFI and XSS via bug_actiongroup_ext_page.php

I don't think my earlier message conveyed the severity of this bug well
enough.

MantisBT allows users to upload attachments to bug reports. These
attachments are commonly stored on the disk in an 'attachments'
directory that should be stored outside the web root (but are still
accessible to MantisBT for retrieval).

This LFI vulnerbility therefore allows arbitrary remote code execution
on a target server (as the web user ID). This level of access could be
used to connect to the MantisBT database and access files and
configuration of other web applications operating under the same uid/gid
as the MantisBT installation.

For example, this LFI vulnerability may allow an attacker to call:
require_once('../var/www/example.com/data/mantisbt/attachments/123456-malicious_attachment.php')

Note that as per the earlier notice, some users (such as those using
nginx) may not be impacted at all.

release-1.2.8 has been tagged at
https://github.com/mantisbt/mantisbt/tree/release-1.2.8 and should be
packaged and distributed via usual channels shortly. Distributors and
users are advised not to wait - patch ASAP or put workarounds in place
such as disallowing attachment uploads ($g_allow_file_upload = OFF in
config_inc.php) if you're using $g_file_upload_method = DISK.

Thanks,

David Hicks
MantisBT Developer
mantisbt.org, #mantishelp irc.freenode.net

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.