Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 19 Jan 2013 10:21:11 +1100
From: David Hicks <d@...id.au>
To: oss-security@...ts.openwall.com
Cc: Roland Becker <roland@...ol.de>, Robert Munteanu
 <robert.munteanu@...il.com>
Subject: CVE request: MantisBT 1.2.12 only summary.php category/project
 names XSS vulnerability

Hi list,

Roland Becker (MantisBT Developer) discovered[1] a XSS vulnerability
introduced in MantisBT 1.2.12 with the display of category/project names
on the summary.php page. Versions of MantisBT other than 1.2.12 are not
affected by this vulnerability.

A malicious MantisBT user holding privileged manager/administrator
permissions could create a category or project name that contains
JavaScript code. Any user visiting summary.php from that point on may
then be exposed to having the malicious JavaScript execute within their
browser environment.

The severity of this issue is limited by the need to hold privileged
manager/administrator permissions in order to modify category and
project names. However -- there are many use cases where MantisBT
installations can have hundreds of sub-projects, each managed by
different people/parties that can not or should not be fully trusted.

Refer to previous commits 3ca8a164[2] and 6ec3f693[3] to trace back the
origin of this vulnerability.

References:
[1] http://www.mantisbt.org/bugs/view.php?id=15384
[2]
https://github.com/mantisbt/mantisbt/commit/3ca8a164641951aba2a459364e656ca0996f8a2b
[3]
https://github.com/mantisbt/mantisbt/commit/6ec3f693d6d212d6bba788681a206c14df43569f

Discussion on the MantisBT Developer Mailing List has indicated that a
release of MantisBT 1.2.13 (resolving both this vulnerability and
CVE-2013-0197 which was announced on this list ~12 hours ago) will not
occur until early next week. As such, a patch is attached for
distributions packaging MantisBT 1.2.12. It is recommended this patch be
applied as soon as possible.

Can a CVE ID please be assigned to this issue?

With thanks,
David Hicks
MantisBT Developer
#mantisbt irc.freenode.net
http://www.mantisbt.org/bugs/

Bcc: mantisbt-dev@...ts.sourceforge.net

From 7df30a9ee703f4d48e6ef8df078cff3a6029c5b9 Mon Sep 17 00:00:00 2001
From: David Hicks <d@...id.au>
Date: Sat, 19 Jan 2013 09:49:13 +1100
Subject: [PATCH] Fix #15384: summary.php XSS vulnerability in MantisBT 1.2.12
 only

Roland Becker (MantisBT Developer) discovered a XSS vulnerability
introduced in MantisBT 1.2.12 with the display of category/project names
on the summary.php page.

A malicious MantisBT user holding privileged manager/administrator
permissions could create a category or project name that contains
JavaScript code. Any user visiting summary.php from that point on may
then be exposed to having the malicious JavaScript execute within their
browser environment.

The severity of this issue is limited by the need to hold privileged
manager/administrator permissions in order to modify category and
project names. However -- there are many use cases where MantisBT
installations can have hundreds of sub-projects, each managed by
different people/parties that can not or should not be fully trusted.

Refer to previous commits 3ca8a164 and 6ec3f693 to trace back the origin
of this vulnerability.
---
 core/summary_api.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/core/summary_api.php b/core/summary_api.php
index abdbbc4..33615b1 100644
--- a/core/summary_api.php
+++ b/core/summary_api.php
@@ -626,9 +626,9 @@ function summary_print_by_category() {
 		$v_category_name = $row['category_name'];
 
 		if(( $v_category_name != $last_category_name ) && ( $last_category_name != -1 ) ) {
-			$label = $last_category_name;
+			$label = string_display_line( $last_category_name );
 			if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {
-				$label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );
+				$label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );
 			}
 
 			$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&amp;' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );
@@ -671,9 +671,9 @@ function summary_print_by_category() {
 	}
 
 	if( 0 < $t_bugs_total ) {
-		$label = $last_category_name;
+		$label = string_display_line( $last_category_name );
 		if(( ON == $t_summary_category_include_project ) && ( ALL_PROJECTS == $t_project_id ) ) {
-			$label = sprintf( '[%s] %s', project_get_name( $last_project ), $label );
+			$label = sprintf( '[%s] %s', string_display_line( project_get_name( $last_project ) ), $label );
 		}
 
 		$t_bug_link = '<a class="subtle" href="' . config_get( 'bug_count_hyperlink_prefix' ) . '&amp;' . FILTER_PROPERTY_CATEGORY . '=' . urlencode( $last_category_name );
@@ -753,7 +753,7 @@ function summary_print_by_project( $p_projects = null, $p_level = 0, $p_cache =
 	}
 
 	foreach( $p_projects as $t_project ) {
-		$t_name = str_repeat( "&raquo; ", $p_level ) . project_get_name( $t_project );
+		$t_name = str_repeat( "&raquo; ", $p_level ) . string_display_line( project_get_name( $t_project ) );
 
 		$t_pdata = isset( $p_cache[$t_project] ) ? $p_cache[$t_project] : array( 'open' => 0, 'resolved' => 0, 'closed' => 0 );
 
-- 
1.8.1.1


[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ