From jlatour@calaquendi.net Tue Aug 20 01:03:58 2002 From: Jeroen Latour X-Sender: To: Bugtraq Date: Mon, 19 Aug 2002 08:48:24 +0200 Subject: [Mantis Advisory/2002-03] Bug listings of private projects can be viewed through cookie manipulation [Mantis Advisory/2002-03] Bug listings of private projects can be viewed through cookie manipulation 0. Table of Contents 1. Introduction 2. Summary / Impact analysis 3. Affected versions 4. Workaround / Solution 5. Detailed explanation 6. Contact details 1. Introduction Mantis is an Open Source web-based bugtracking system, written in PHP, which uses the MySQL database server. It is being actively developed by a small group of developers, and is considered to be in the beta stage. 2. Summary / Impact analysis In Mantis a user can select a project from a drop-down menu. After selection, all bug listings will be limited to that project. The 'View Bugs' page, which is responsible for displaying a list of bugs in a project, did not check whether the user actually had access to the project defined in the cookie. It trusted the fact that only projects accessible to the user were listed in the drop-down menu. This provides a malicious user with an opportunity to display the 'View Bugs' page with a private project selected. This has been fixed in Mantis 0.17.4. It should be noted that this bug does not allow a user to get any more information than is listed in the View Bugs page. The page with more information about the bug is not accessible. Also, private bugs are still not visible in the list. 3. Affected versions The following versions are known to be affected: Mantis 0.17.3 The following versions are known to be unaffected: Mantis 0.17.4a Mantis 0.17.4 The following versions are presumed to be affected: Any version below Mantis 0.17.3 4. Workaround / Solution Mantis 0.17.4 adds the appropriate permission checks to the 'View Bugs' page. All users are recommended to upgrade to this version as soon as possible. If an upgrade is not an option, view_all_bug_page.php can be patched to add the appropriate checks. To do so, add the following function to core_user_API.php: # Check to see if the current user has access on the specified project function check_access_to_project( $p_project_id ) { $t_project_view_state = get_project_field( $p_project_id, 'view_state' ); # Administrators ALWAYS pass. if ( get_current_user_field( 'access_level' ) >= ADMINISTRATOR ) { return; } # public project accept all users if ( PUBLIC == $t_project_view_state ) { return; } else { # private projects require users to be assigned $t_project_access_level = get_project_access_level( $p_project_id ); # -1 means not assigned, kick them out to the project selection screen if ( -1 == $t_project_access_level ) { print_header_redirect( 'login_select_proj_page.php' ); } else { # passed return; } } } And in view_all_bug_page.php, replace the following lines: $t_where_clause .= ')'; } } else { $t_where_clause = " WHERE project_id='$g_project_cookie_val'"; } # end project selection with the following lines: $t_where_clause .= ')'; } } else { check_access_to_project($g_project_cookie_val); $t_where_clause = " WHERE project_id='$g_project_cookie_val'"; } # end project selection 5. Detailed explanation To take advantage of this vulnerability, the attacker would need to know the project_id of the private project he wishes to attack. This is not terribly difficult to accomplish, as the project_id starts at 1 and increases by one for every project created. The attacker can just try each integer starting at 1, until (s)he finds the one (s)he's looking for. The next step is to log in to Mantis at least once, so that the MANTIS_PROJECT_COOKIE, or however the cookie is called in that particular set-up, is set. The user can then manually change the cookie locally, and fill in the desired project_id. Now all the user has to do is visit /view_all_bug_page.php, and the list of public bugs in that project should be displayed. An alternative method is by forging the HTTP headers, to send the desired cookie value with a request for /view_all_bug_page.php. The results are the same. 6. Contact details The latest version of Mantis is always available from: http://mantisbt.sourceforge.net/ The current version is 0.17.4a, which can be downloaded from http://mantisbt.sourceforge.net/download.php3 If you have any questions about this vulnerability, or wish to report another, you can contact the developers at: mailto:mantisbt-security@lists.sourceforge.net This is a private mailinglist, readable only by a few developers. The latest version of this and other advisories can be found at: http://mantisbt.sourceforge.net/security.php3