oss-security - CVE-2014-9571: XSS in install.php

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 17 Jan 2015 00:59:38 +0100
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Cc: advisory@...ridge.ch
Subject: CVE-2014-9571: XSS in install.php

Greetings,

Please update CVE-2014-9571 with the information below

Description:

Vulnerabilities described in this section can be used by attackers to 
steal cookies of application’s administrator and other website users. 
Attackers can also perform spear phishing attacks against web site 
visitors by replacing original content of the web site with arbitrary 
HTML and script code, perform drive-by-download attacks by injecting 
malware into web pages, and bypass existing CSRF protection mechanism.

The vulnerability exists due to insufficient filtration of input data 
passed via the "admin_username" and "admin_password" HTTP GET parameters 
to "/[admin]/install.php" script. A remote attacker can trick a 
logged-in user to open a specially crafted link and execute arbitrary 
HTML and script code in browser in context of the vulnerable website.

Below are two exploitation examples that use the "alert()" JavaScript 
function to display "immuniweb" word:

http://mantis/[admin]/install.php?install=1&admin_username=1%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E
http://mantis/[admin]/install.php?install=1&admin_password=1%27%22%3E%3Cscript%3Ealert%28%27immuniweb%27%29;%3C/script%3E

Note, that "[admin]" in the URL is changed by default during MantisBT 
installation. Therefore, the attacker must know the location of the 
administrative interface in order to perform the attack. However, admin 
panel URL can be bruteforced or predicted in many cases.

Affected versions:
- <= 1.2.19
- <= 1.3.0-beta.1

Fixed in versions:
- 1.2.19 (not yet released)
- 1.3.0-beta.2 (not yet released)

Patch:
See Github [1]

Credit:
This vulnerability was reported [2] by High-Tech Bridge Security 
Research Lab (https://www.htbridge.com/), via advisory ID HTB23243 [3].
The issue was fixed by Damien Regad (MantisBT Developer).

References:
Further details available in our issue tracker [4]

[1] http://github.com/mantisbt/mantisbt/commit/6d47c047 (1.2.x)
     http://github.com/mantisbt/mantisbt/commit/132cd6d0 (1.3.x)
[2] https://www.mantisbt.org/bugs/view.php?id=17937
[3] https://www.htbridge.com/advisory/HTB23243
[4] https://www.mantisbt.org/bugs/view.php?id=17938

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.