BID:14604

Mantis Multiple Input Validation Vulnerabilities

Info

Mantis Multiple Input Validation Vulnerabilities

Bugtraq ID:	14604
Class:	Input Validation Error
CVE:	CVE-2005-2556 CVE-2005-2557
Remote:	Yes
Local:	No
Published:	Aug 19 2005 12:00AM
Updated:	Jul 12 2009 05:06PM
Credit:	The vendor announced these vulnerabilities.
Vulnerable:	Mantis Mantis 1.0 .0rc1 Mantis Mantis 1.0 .0a3 Mantis Mantis 1.0 .0a2 Mantis Mantis 1.0 .0a1 Mantis Mantis 0.19.2 Mantis Mantis 0.19.1 Mantis Mantis 0.19 .0RC1 Mantis Mantis 0.19 .0a1 Mantis Mantis 0.19 .0a Mantis Mantis 0.19 .0 Mantis Mantis 0.18.3 Mantis Mantis 0.18.2 Mantis Mantis 0.18 a1 Mantis Mantis 0.18 0rc1 Mantis Mantis 0.18 0a4 Mantis Mantis 0.18 0a3 Mantis Mantis 0.18 0a2 Mantis Mantis 0.18 Mantis Mantis 0.17.5 Mantis Mantis 0.17.5 Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 Mantis Mantis 0.17.4 Mantis Mantis 0.17.3 Mantis Mantis 0.17.3 Mantis Mantis 0.17.2 Mantis Mantis 0.17.2 Mantis Mantis 0.17.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 Mantis Mantis 0.17.1 Mantis Mantis 0.17 .0 Mantis Mantis 0.17 Mantis Mantis 0.16.1 Mantis Mantis 0.16.1 Mantis Mantis 0.16 .0 Mantis Mantis 0.16 Mantis Mantis 0.15.12 Mantis Mantis 0.15.12 Mantis Mantis 0.15.11 Mantis Mantis 0.15.11 Mantis Mantis 0.15.10 Mantis Mantis 0.15.9 Mantis Mantis 0.15.9 Mantis Mantis 0.15.8 Mantis Mantis 0.15.8 Mantis Mantis 0.15.7 Mantis Mantis 0.15.7 Mantis Mantis 0.15.6 Mantis Mantis 0.15.6 Mantis Mantis 0.15.5 Mantis Mantis 0.15.5 Mantis Mantis 0.15.4 Mantis Mantis 0.15.4 Mantis Mantis 0.15.3 Mantis Mantis 0.15.3 Mantis Mantis 0.15.2 Mantis Mantis 0.15.1 Mantis Mantis 0.15 Mantis Mantis 0.14.8 Mantis Mantis 0.14.7 Mantis Mantis 0.14.6 Mantis Mantis 0.14.5 Mantis Mantis 0.14.4 Mantis Mantis 0.14.3 Mantis Mantis 0.14.2 Mantis Mantis 0.14.1 Mantis Mantis 0.14 Mantis Mantis 0.13.1 Mantis Mantis 0.13 Mantis Mantis 0.12 Mantis Mantis 0.11.1 Mantis Mantis 0.11 Mantis Mantis 0.10.2 Mantis Mantis 0.10.1 Mantis Mantis 0.10 Mantis Mantis 0.9.1 Mantis Mantis 0.9 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1

Not Vulnerable:	Mantis Mantis 1.0 .0rc2 Mantis Mantis 1.0 .0rc1 Mantis Mantis 0.18.3

Discussion

Mantis Multiple Input Validation Vulnerabilities

Mantis is prone to multiple input validation vulnerabilities. These issues involve cross-site scripting, HTML injection and variable poisoning, and are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Successful exploitation of the HTML injection issue could result in having attacker-supplied HTML and script code executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

The variable poisoning issue could result in unauthorized access and denial of service attacks.

Exploit / POC

Mantis Multiple Input Validation Vulnerabilities

No exploit is required.

Samples have been provided:

A - Cross Site Scripting Vulnerabilities

http://www.example.com/view_all_set.php?sort=severity&dir="><script>alert(document.cookie)</script>&type=2

B.- Database scanner via variable poisoning

http://www.example.com/core/database_api.php?g_db_type=mysql://invaliduser@localhost:3336
http://www.example.com/core/database_api.php?g_db_type=mysql://root@localhost:3336
http://www.example.com/core/database_api.php?g_db_type=informix://localhost:8080
http://www.example.com/core/database_api.php?g_db_type=mysql://[email protected]

Solution / Fix

Mantis Multiple Input Validation Vulnerabilities

Solution:
The vendor has addressed these issues in the latest release.

Debian Linux has released security advisory DSA 778-1 addressing these issues. Please see the referenced advisory for further information.

Gentoo has released advisory GLSA 200509-16 to address these issues. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/mantisbt-0.19.2"

Issues for the cross-site scripting and HTML injection vulnerabilities are corrected in Mantis version 1.0.0RC1.

Mantis Mantis 0.10