View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0017939 | mantisbt | security | public | 2014-12-03 15:04 | 2015-01-27 04:48 |
Reporter | htbridge | Assigned To | dregad | ||
Priority | normal | Severity | major | Reproducibility | have not tried |
Status | closed | Resolution | fixed | ||
Product Version | 1.2.17 | ||||
Target Version | 1.2.19 | Fixed in Version | 1.2.19 | ||
Summary | 0017939: CVE-2014-9572: Improper Access Control in install.php | ||||
Description | The vulnerability exists due to insufficient access restrictions to the installation script "/[admin]/install.php" when HTTP GET "install" parameter is set to "4". A remote unauthenticated attacker can access the installation script and obtain database access credentials, which are stored in plain text in hidden form fields. An attacker can use the following URL to access the page an obtain database credentials (login and password) in plaintext: http://mantis/[admin]/install.php?install=4 Note, that "[admin]" in the URL is changed by default during installation. Therefore, the attacker must know the location of the administrative interface in order to perform the attack. However, admin panel URL can be bruteforced or predicted in many cases. | ||||
Additional Information | Advisory ID: HTB23243 Original report in 0017937 | ||||
Tags | No tags attached. | ||||
Attached Files | 0003-Install-disable-step-4-additional-config-info.patch (1,640 bytes)
From 692a9b9d2f87e6fd368f404be61aa8dc55cdfc2b Mon Sep 17 00:00:00 2001 From: Damien Regad <dregad@mantisbt.org> Date: Sun, 28 Dec 2014 12:29:51 +0100 Subject: [PATCH 3/3] Install: disable step 4 (additional config info) This fixes a security issue allowing an attacker to access the installation script and obtain database access credentials. Since the offending install step does not seem to be doing anything useful, the corresponding code block has been commented out. This vulnerability was reported by High-Tech Bridge Security Research Lab (https://www.htbridge.com/) in issue #17937 (advisory ID HTB23243). Fixes #17939 --- admin/install.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/admin/install.php b/admin/install.php index 577a32d..77f6163 100644 --- a/admin/install.php +++ b/admin/install.php @@ -751,7 +751,12 @@ if( 3 == $t_install_state ) { # database installed, get any additional information if( 4 == $t_install_state ) { - /** @todo to be written */ +/* + # 20141227 dregad Disabling this step for now, because it does not seem to + # be doing anything useful and can be used to retrieve system information + # when the admin directory has not been deleted (see #17939). + + # @todo to be written // must post data gathered to preserve it ?> <input name="hostname" type="hidden" value="<?php echo string_attribute( $f_hostname ) ?>"></input> @@ -766,6 +771,7 @@ if( 4 == $t_install_state ) { <?php # must post <input name="install" type="hidden" value="5"></input> # rather than the following line +*/ $t_install_state++; } # end install_state == 4 -- 1.9.1 | ||||
related to | 0017938 | closed | dregad | CVE-2014-9571: XSS in install.php |
related to | 0017940 | closed | dregad | CVE-2014-9573: SQL Injection in manage_user_page.php |
has duplicate | 0019273 | closed | dregad | CVE-2014-9572: Improper Access Control in install.php |
child of | 0017937 | closed | dregad | MantisBT Security Vulnerability Notification (HTB23243) |
MantisBT: master-1.2.x 5571bcf9 2014-12-28 01:29 Details Diff |
Install: disable step 4 (additional config info) This fixes a security issue allowing an attacker to access the installation script and obtain database access credentials. Since the offending install step does not seem to be doing anything useful, the corresponding code block has been commented out. This vulnerability (CVE-2014-9571) was reported by High-Tech Bridge Security Research Lab (https://www.htbridge.com/) in issue 0017937 (advisory ID HTB23243). Fixes 0017939 |
Affected Issues 0017937, 0017939 |
|
mod - admin/install.php | Diff File | ||
MantisBT: master 5e5e5750 2014-12-28 01:29 Details Diff |
Install: disable step 4 (additional config info) This fixes a security issue allowing an attacker to access the installation script and obtain database access credentials. Since the offending install step does not seem to be doing anything useful, the corresponding code block has been commented out. This vulnerability (CVE-2014-9571) was reported by High-Tech Bridge Security Research Lab (https://www.htbridge.com/) in issue 0017937 (advisory ID HTB23243). Fixes 0017939 |
Affected Issues 0017937, 0017939, 0019273 |
|
mod - admin/install.php | Diff File |