Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 08 Nov 2014 00:09:26 +0100
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-8598: MantisBT XML Import/Export plugin unrestricted access

Mitre assigned CVE-2014-8598 to this issue.

Description:

The XML Import/Export "official" plugin (i.e. bundled with MantisBT 
releases) currently does not perform any access level checks in the 
import and export pages. This leads to the following vulnerabilities:

1) import

Any user of a MantisBT instance with the XML plugin enabled and knowing 
the URL to the plugin's import page could upload an XML file and insert 
data without restriction, regardless of their access level.

This vulnerability is particularly dangerous when used in combination 
with the one described in issue #17725 [1] (CVE-2014-7146) as it makes 
for a very simple and easily accessible vector for PHP code injection 
attacks.

2) export

There was also no access check when exporting data, which could allow an 
attacker to gain access to confidential information (disclosure of all 
bug-related data, including usernames).

Systems where the patch described below cannot be applied are strongly 
advised to uninstall the plugin.


Affected versions:
>= 1.2.0a3, <= 1.2.17

Fixed in versions:
1.2.18 (not yet released)

Patch:
See Github [3]

Credit:
Issue was discovered and fixed by Damien Regad (MantisBT Developer)

References:
Further details available in our issue tracker [2]


[1] http://www.mantisbt.org/bugs/view.php?id=17725
[2] http://www.mantisbt.org/bugs/view.php?id=17780
[3] https://github.com/mantisbt/mantisbt/commit/80a15487

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ