CVE-2017-7620: MantisBT CSRF and Open Redirect Vulnerability
Summary
CVE-2017-7620: MantisBT vulnerable to CSRF and Open Redirect attacks. Affects mantisbt/mantisbt across 3 version ranges.
< 1.3.11
>= 2.0.0, < 2.3.3
>= 2.4.0, < 2.4.1
Fixed in 1.3.11, 2.3.3 or 2.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that helps teams manage software development projects by tracking issues and bugs. It provides features such as issue tracking, project management, and reporting. However, certain versions of MantisBT are vulnerable to CSRF and Open Redirect attacks, which can compromise the integrity of the application and its users.
Vulnerability Detail
The vulnerability arises from a lack of proper validation in the string_api.php file in MantisBT versions before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1. This oversight allows an attacker to exploit the application by injecting arbitrary permalinks through CSRF attacks on the permalink_page.php?url= URI. Additionally, it enables open redirects via the login_page.php?return= URI, potentially leading users to malicious sites. The conflicting interpretations of an initial backslash in URLs can lead to unauthorized access and manipulation of user sessions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.111.3.11composer require mantisbt/mantisbt:1.3.11 -
>= 2.0.0, < 2.3.32.3.3composer require mantisbt/mantisbt:2.3.3 -
>= 2.4.0, < 2.4.12.4.1composer require mantisbt/mantisbt:2.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that users are educated about the risks of clicking on untrusted links and consider implementing additional security measures such as CSRF tokens for sensitive actions until the software can be updated.
Conclusion
The MantisBT vulnerability CVE-2017-7620 poses significant risks through CSRF and Open Redirect attacks. It is crucial for users to update to the latest versions to protect their applications and users from potential exploitation. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
MantisBT versions before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
CSRF (Cross-Site Request Forgery) attacks trick users into executing unwanted actions on a web application in which they are authenticated, while Open Redirect attacks redirect users to malicious sites.
If immediate updates are not possible, implement security measures such as user education and additional validation checks to mitigate the risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
