CVE-2024-23830: MantisBT Host Header Injection vulnerability
Summary
CVE-2024-23830: MantisBT Host Header Injection vulnerability. Affects mantisbt/mantisbt versions < 2.26.1. Fixed in 2.26.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that helps software development teams track and manage issues throughout the software development lifecycle. It provides a web-based interface for users to report bugs, track their progress, and collaborate on resolving them. MantisBT is widely used in various industries and has a large user base.
However, a vulnerability has been discovered in MantisBT that allows an unauthenticated attacker to hijack a user's account by exploiting a host header injection vulnerability. By manipulating the link in the password reset notification message, an attacker can gain unauthorized access to a user's account.
Vulnerability Detail
The MantisBT Host Header Injection vulnerability allows an attacker to hijack a user's account by poisoning the link in the password reset notification message. This vulnerability can be exploited by an attacker who knows the target user's email address and username. By injecting a malicious host header, the attacker can manipulate the password reset link and redirect it to a malicious website controlled by the attacker. When the user clicks on the manipulated link, their account credentials can be compromised, leading to unauthorized access and potential misuse of the account.
This vulnerability has a CVSS score of 8.3, indicating a high severity level.
How To Fix
Minimum fixed version
2.26.1
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.26.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can define the $g_path variable appropriately in the config_inc.php file. By setting the correct value for $g_path, the vulnerability can be mitigated. However, this is not a permanent solution, and it is strongly advised to update to the latest version of MantisBT as soon as possible.
Conclusion
The MantisBT Host Header Injection vulnerability allows an attacker to hijack user accounts by manipulating the password reset link. To mitigate this vulnerability, it is crucial to update MantisBT to version 2.26.1 or later. In the meantime, defining the $g_path variable in the config_inc.php file can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
MantisBT is an open-source bug tracking system used by software development teams to track and manage issues throughout the software development lifecycle.
The vulnerability allows an attacker to hijack a user's account by manipulating the password reset link. This can lead to unauthorized access and potential misuse of the account.
To fix the vulnerability, update MantisBT to version 2.26.1 or later. The latest version includes a patch that addresses the host header injection vulnerability.
Yes, as a temporary workaround, users can define the $g_path variable in the config_inc.php file. However, it is recommended to update to the latest version of MantisBT for a permanent solution.
The vulnerability was responsibly reported by several security researchers, including Pier-Luc Maltais, Hlib Yavorskyi, Jingshao Chen, Brandon Roldan, and nhchoudhary.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
