GHSA-pq86-j2c2-47f6 — MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

The advisory, in context

The mc_issue_update() function in MantisBT allows users having update_bug_threshold access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function.

Impact

UPDATER can edit notes by DEVELOPER/MANAGER/ADMIN — bypassing the DEVELOPER threshold
UPDATER can change private notes to public — exposing confidential internal discussion
UPDATER can change public notes to private — hiding information from reporters/viewers

Patches

6e58fae4f22efdc3987f903c8ba2611de17a9435

Workarounds

None

Credits

Thanks to the following security researchers for independently discovering and responsibly reporting the issue.

Vishal Shukla
Tristan Madani (@TristanInSec) from Talence Security

This advisory's contents was largely copied from Tristan's well-written report.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

mantisbt/mantisbt Packagist

Ecosystem versions

Earlier releases before 2.28.2

Fixed in 2.28.2

76 explicitly affected versions

2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 2.12.2, 2.13.0, 2.13.1, 2.13.2, 2.14.0, 2.15.0, 2.15.1, 2.16.0, 2.16.1, 2.17.0, 2.17.1, 2.17.2, 2.18.0, 2.18.1, 2.19.0, 2.19.1, 2.20.0, 2.20.1, 2.21.0, 2.21.1, 2.21.2, 2.21.3, 2.22.0, 2.22.1, 2.22.2, 2.23.0, 2.23.1, 2.24.0, 2.24.1, 2.24.2, 2.24.3, 2.24.4, 2.24.5, 2.25.0, 2.25.1, 2.25.2, 2.25.3, 2.25.4, 2.25.5, 2.25.6, 2.25.7, 2.25.8, 2.26.0, 2.26.1, 2.26.2, 2.26.3, 2.26.4, 2.27.0, 2.27.1, 2.27.2, 2.27.3, 2.28.0, 2.28.1, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.9.0, 2.9.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.28.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.10.0",
    "2.10.1",
    "2.11.0",
    "2.11.1",
    "2.12.0",
    "2.12.1",
    "2.12.2",
    "2.13.0",
    "2.13.1",
    "2.13.2",
    "2.14.0",
    "2.15.0",
    "2.15.1",
    "2.16.0",
    "2.16.1",
    "2.17.0",
    "2.17.1",
    "2.17.2",
    "2.18.0",
    "2.18.1",
    "2.19.0",
    "2.19.1",
    "2.20.0",
    "2.20.1",
    "2.21.0",
    "2.21.1",
    "2.21.2",
    "2.21.3",
    "2.22.0",
    "2.22.1",
    "2.22.2",
    "2.23.0",
    "2.23.1",
    "2.24.0",
    "2.24.1",
    "2.24.2",
    "2.24.3",
    "2.24.4",
    "2.24.5",
    "2.25.0",
    "2.25.1",
    "2.25.2",
    "2.25.3",
    "2.25.4",
    "2.25.5",
    "2.25.6",
    "2.25.7",
    "2.25.8",
    "2.26.0",
    "2.26.1",
    "2.26.2",
    "2.26.3",
    "2.26.4",
    "2.27.0",
    "2.27.1",
    "2.27.2",
    "2.27.3",
    "2.28.0",
    "2.28.1",
    "2.3.0",
    "2.3.1",
    "2.3.2",
    "2.3.3",
    "2.4.0",
    "2.4.1",
    "2.4.2",
    "2.5.0",
    "2.5.1",
    "2.5.2",
    "2.6.0",
    "2.7.0",
    "2.7.1",
    "2.8.0",
    "2.8.1",
    "2.9.0",
    "2.9.1"
  ]
}

Set up in your agent.

Investigate in your agent.