CVE-2017-7309: MantisBT XSS Vulnerability in Configuration Report Page
Summary
CVE-2017-7309: MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php. Affects mantisbt/mantisbt across 3 version ranges.
< 1.3.9
>= 2.1.0, < 2.1.3
>= 2.2.0, < 2.2.3
Fixed in 1.3.9, 2.1.3 or 2.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker designed for software development projects. It provides features such as bug tracking, project management, and reporting capabilities. However, like many web applications, it is susceptible to security vulnerabilities. The specific issue at hand is a cross-site scripting (XSS) vulnerability that can be exploited through the 'config_option' parameter in the adm_config_report.php file.
Vulnerability Detail
The vulnerability arises from inadequate input validation in the 'config_option' parameter, allowing attackers to inject arbitrary JavaScript code into the web application. If the Content Security Policy (CSP) settings permit, this injected code can be executed in the context of a user's browser, potentially leading to session hijacking, data theft, or other malicious activities. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.91.3.9composer require mantisbt/mantisbt:1.3.9 -
>= 2.1.0, < 2.1.32.1.3composer require mantisbt/mantisbt:2.1.3 -
>= 2.2.0, < 2.2.32.2.3composer require mantisbt/mantisbt:2.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can implement input validation on the 'config_option' parameter to sanitize user input. This can help mitigate the risk of XSS attacks until the package is updated. Example code for sanitization:
if (isset($_GET['config_option'])) {
$config_option = htmlspecialchars($_GET['config_option'], ENT_QUOTES, 'UTF-8');
}
Conclusion
The XSS vulnerability in MantisBT (CVE-2017-7309) poses a significant risk to users by allowing attackers to inject malicious scripts. It is crucial to update to the patched versions to mitigate this risk. Regular monitoring and adherence to security best practices can further enhance the safety of your application.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
CVE-2017-7309 is a cross-site scripting (XSS) vulnerability in MantisBT that allows attackers to inject malicious scripts through the 'config_option' parameter.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
If exploited, this vulnerability can lead to unauthorized access to user sessions, data theft, and other malicious activities.
The safe versions are 1.3.9, 2.1.3, and 2.2.3. Ensure your installation is updated to one of these versions.
Implement input validation and output encoding for all user inputs, and regularly update your software to the latest versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
