CVE-2017-12061: MantisBT XSS Vulnerability in Installation Script
Summary
CVE-2017-12061: MantisBT XSS allows unsanitized input via admin/install.php. Affects mantisbt/mantisbt across 2 version ranges.
< 1.3.12
>= 2.0.0, < 2.5.2
Fixed in 1.3.12 or 2.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that helps teams manage and track issues effectively. It offers features such as issue tracking, project management, and reporting. However, prior to versions 1.3.12 and 2.5.2, MantisBT contained a vulnerability in its installation script that allowed unsanitized user input, leading to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
An XSS vulnerability was identified in the admin/install.php file of MantisBT versions before 1.3.12 and 2.x before 2.5.2. The vulnerability arises from the lack of proper sanitization of user-controlled variables, such as $f_database, $f_db_username, and $f_admin_username. This oversight enables remote attackers to inject arbitrary JavaScript code, which could lead to session hijacking, data theft, or other malicious actions. The risk is somewhat mitigated by the recommendation to delete the admin folder post-installation and the implementation of Content Security Policy (CSP).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.121.3.12composer require mantisbt/mantisbt:1.3.12 -
>= 2.0.0, < 2.5.22.5.2composer require mantisbt/mantisbt:2.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the admin folder is deleted after the installation process is complete. Additionally, implementing a Content Security Policy (CSP) can help mitigate the risk of XSS attacks.
Conclusion
The XSS vulnerability in MantisBT's installation script poses a significant risk to users of affected versions. It is crucial to update to the latest patched versions to safeguard against potential attacks. Implementing workarounds such as deleting the admin folder and employing CSP can provide additional protection.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious JavaScript code through unsanitized input in the installation script.
If you are using MantisBT versions prior to 1.3.12 or 2.x before 2.5.2, your installation is vulnerable.
Attackers could exploit this vulnerability to execute arbitrary JavaScript in the context of a user's session, leading to data theft or unauthorized actions.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the composer.lock file. You can check your application for vulnerabilities without any signup using the Vulert playground.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
