Summary:
Product: MantisBT
Proveedor: MantisBT Team
Vulnerable version: 2.24.3
Public divulgation: December 11 - 2020
Vulnerability type: SQL injection (CWE-89) (CWE-943)
Level Risk: Medium
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Discovered by: EthicalHCOP

Hello,

Many thanks for your report and responsible disclosure.

I believe that the vulnerability you discovered, should be fixed in the current master branch (2.25.0-dev since commit MantisBT master 682a182d ).

Would you be able to test again to confirm, using the latest nightly build ?

The code in project API allowing the SQL injection by not using query parameters exists at least since 1.0.0.a1.

The exploitable vulnerability via SOAP API described here, exists since 1.1.0a4.

@ethicalhcop waiting for your confirmation that code in master branch is no longer vulnerable (as far as I can tell, it is not).

Hello dregad.

Yes sure, let me try again in the night and report you tomorrow :D !

Regards.

Hello.

let me tell you that I retest the app again in the bb10211 compilation and the vulnerability was fixed successfully.

So, remember that I will make the public divulgation at December 11.
The mantisbt team have any protocol to make public the vulnerability for pentesters?

Regularly I do a walkthrought and write a script to exploit the vulnerability , I don't know if do you have some protocol.

mantis_dev2.25_1.png (50,587 bytes)   

mantis_dev2.25_1.png (50,587 bytes)   

mantis_dev2.25_2.png (56,634 bytes)   

mantis_dev2.25_2.png (56,634 bytes)   

The mantisbt team have any protocol to make public the vulnerability for pentesters?

Not sure what you mean by protocol.
When a patch for a security issue is ready, we just release a new version including the fix and announce it via our usual channels, referencing the CVE ID if applicable.

Perfect !

thank you for all.
Regards !

So, remember that I will make the public divulgation at December 11.

@ethicalcop, I'm sorry, but the December 11 deadline you set might turn out to be a little short, as I have a series of other security issues that I'm still working on, and I'm not 100% sure at this time, that I'll have everything ready by Friday.

Would you mind postponing your going public by a few days ? I'll give you the green light as soon as I'm done.

@ethicalhcop Thanks for your understanding. I'll ping you here as soon as I'm ready.

next saturday december 26, I will to participate on a little security meetup where I will to talk about the CVE !

Thanks for the heads up. I was hoping to finalize fixing the other issues last week-end but unfortunately didn't have enough time.

So now there are a few options (in my order of preference / feasibility):

1. when you make your presentation, you make it clear that the issue is has not yet been fully disclosed to the public and so it should be kept confidential
2. I release 2.24.4 with only some of the other issues fixed, and plan for another 2.24.5 (probably best, but takes some effort on my end)
3. I manage to finalize fixes and release 2.24.4 with everything as planned initially before 26th (unlikely)

Let me know your thoughts.