Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 27 Aug 2016 23:16:56 +0200
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: MantisBT weakened CSP when using bundled Gravatar plugin

Greetings,

Please assign a CVE ID for the following issue.

Description
-----------
MantisBT 1.3.0-rc.2 introduced a new bundled plugin to handle display of
users' avatars using Gravatar.

Instead of adding the Gravatar web site to the list of allowed image
sources in MantisBT's Content Security Policy, the plugin was replacing
the whole policy by:

   img-src 'self' http://www.gravatar.com/

instead of the more strict default one of:

   default-src 'self'; frame-ancestors 'none'; style-src 'self';
   script-src 'self'

Relaxed policy allows execution of remote and inline scripts, e.g.
potentially enabling XSS attacks.


Affected versions
-----------------
- >= 1.3.0-rc.2
- >= 2.0.0-beta.1

Fixed in versions:
------------------
- 1.3.1
- 2.0.0-beta.2

As of this writing, these have not been released yet, but both should be
available in the coming days. Until then, installations should be
patched manually.

As a workaround, disabling the Gravatar plugin restores the safer
default policy.

Patch
-----
See Github [1]

Credits
-------
The issue was discovered by Johannes Schultz, and fixed by Victor Boctor
(MantisBT Developer).

References
----------
Further details available in our issue tracker [2]


Best regards,
D. Regad
MantisBT Developer
http://mantisbt.org


[1] https://github.com/mantisbt/mantisbt/commit/b3511d2f
[2] https://mantisbt.org/bugs/view.php?id=21263

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.