Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 17 Jan 2015 01:01:55 +0100
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Cc: advisory@...ridge.ch
Subject: CVE-2014-9572: Improper Access Control in install.php

Greetings,

Please update CVE-2014-9572 with the information below


Description:

The vulnerability exists due to insufficient access restrictions to the 
installation script "/[admin]/install.php" when HTTP GET "install" 
parameter is set to "4". A remote unauthenticated attacker can access 
the installation script and obtain database access credentials, which 
are stored in plain text in hidden form fields.

An attacker can use the following URL to access the page and obtain 
database credentials (login and password) in plaintext:

http://mantis/[admin]/install.php?install=4 [^]

Note, that "[admin]" in the URL is changed by default during 
installation. Therefore, the attacker must know the location of the 
administrative interface in order to perform the attack. However, admin 
panel URL can be bruteforced or predicted in many cases.


Affected versions:
- <= 1.2.19
- <= 1.3.0-beta.1

Fixed in versions:
- 1.2.19 (not yet released)
- 1.3.0-beta.2 (not yet released)

Patch:
See Github [1]

Credit:
This vulnerability was reported [2] by High-Tech Bridge Security 
Research Lab (https://www.htbridge.com/), via advisory ID HTB23243 [3].
The issue was fixed by Damien Regad (MantisBT Developer).

References:
Further details available in our issue tracker [4]

[1] http://github.com/mantisbt/mantisbt/commit/5571bcf9 (1.2.x)
     http://github.com/mantisbt/mantisbt/commit/5e5e5750 (1.3.x)
[2] https://www.mantisbt.org/bugs/view.php?id=17937
[3] https://www.htbridge.com/advisory/HTB23243
[4] https://www.mantisbt.org/bugs/view.php?id=17939


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ