CVE-2022-33910: MantisBT XSS Vulnerability via Crafted SVG Documents
Summary
CVE-2022-33910: MantisBT XSS through crafted SVG documents in file_download.php. Affects mantisbt/mantisbt versions < 2.25.5. Fixed in 2.25.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker designed for software development projects. It provides features such as bug tracking, project management, and collaboration tools. However, prior to version 2.25.5, MantisBT was vulnerable to an XSS attack that allowed remote attackers to exploit the system by attaching malicious SVG documents to issue reports or bugnotes.
Vulnerability Detail
The vulnerability arises from improper handling of SVG file attachments in the file_download.php script. When a user or admin clicks on a crafted SVG document, instead of downloading the file, the document is opened in a browser tab. This behavior allows any embedded JavaScript code within the SVG to execute, potentially compromising user sessions or leading to further attacks.
How To Fix
Minimum fixed version
2.25.5
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.25.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict users from uploading SVG files as attachments until the package is updated. This can be done by modifying the file upload settings in the MantisBT configuration.
Conclusion
The XSS vulnerability in MantisBT prior to version 2.25.5 poses a significant risk to users by allowing remote attackers to execute JavaScript through malicious SVG attachments. It is crucial to update to the patched version to mitigate this risk.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The vulnerability is an XSS (Cross-Site Scripting) issue that allows attackers to execute JavaScript code through crafted SVG file attachments.
If you are using a version prior to 2.25.5, your installation is vulnerable. You can check your version in the MantisBT dashboard.
An attacker could execute malicious scripts in the context of a user's session, potentially leading to data theft or unauthorized actions.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
