Date: Sat, 27 Aug 2016 23:16:56 +0200 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Subject: MantisBT weakened CSP when using bundled Gravatar plugin Greetings, Please assign a CVE ID for the following issue. Description ----------- MantisBT 1.3.0-rc.2 introduced a new bundled plugin to handle display of users' avatars using Gravatar. Instead of adding the Gravatar web site to the list of allowed image sources in MantisBT's Content Security Policy, the plugin was replacing the whole policy by: img-src 'self' http://www.gravatar.com/ instead of the more strict default one of: default-src 'self'; frame-ancestors 'none'; style-src 'self'; script-src 'self' Relaxed policy allows execution of remote and inline scripts, e.g. potentially enabling XSS attacks. Affected versions ----------------- - >= 1.3.0-rc.2 - >= 2.0.0-beta.1 Fixed in versions: ------------------ - 1.3.1 - 2.0.0-beta.2 As of this writing, these have not been released yet, but both should be available in the coming days. Until then, installations should be patched manually. As a workaround, disabling the Gravatar plugin restores the safer default policy. Patch ----- See Github  Credits ------- The issue was discovered by Johannes Schultz, and fixed by Victor Boctor (MantisBT Developer). References ---------- Further details available in our issue tracker  Best regards, D. Regad MantisBT Developer http://mantisbt.org  https://github.com/mantisbt/mantisbt/commit/b3511d2f  https://mantisbt.org/bugs/view.php?id=21263
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.