CVE-2021-43257: MantisBT CSV Injection Vulnerability Allows Unprivileged User Access
Summary
CVE-2021-43257: MantisBT CSV Injection unprivileged user access in csv_export.php. Affects mantisbt/mantisbt versions < 2.25.3. Fixed in 2.25.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker that helps teams manage and track software development projects. It provides features such as bug tracking, project management, and reporting. However, prior to version 2.25.3, MantisBT had a vulnerability in its CSV export functionality that could be exploited by unprivileged users.
Vulnerability Detail
The vulnerability arises from a lack of neutralization of formula elements in the CSV API of MantisBT. This allows an unprivileged attacker to inject malicious code into the CSV files generated by the csv_export.php script. When these files are opened in spreadsheet applications like Excel, the injected code can execute, potentially leading to unauthorized access to sensitive information or execution of arbitrary commands.
How To Fix
Minimum fixed version
2.25.3
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.25.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening CSV files generated by MantisBT in applications that support formula execution, such as Excel. Instead, use a plain text editor to view the contents of the CSV file.
Conclusion
The CVE-2021-43257 vulnerability in MantisBT allows unprivileged users to exploit the CSV export functionality, leading to potential code execution and information exposure. It is crucial to update to version 2.25.3 or later to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
An unprivileged user can exploit this vulnerability by generating a CSV file through the MantisBT interface.
Exploitation of this vulnerability can lead to unauthorized code execution and exposure of sensitive information when the CSV file is opened in a vulnerable application.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without requiring access to the code or installation. Simply upload your composer.lock file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
