MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
The advisory, in context
MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature (adm_config_set.php). When setting a configuration value with a non-string type (integer, float, complex), the value is passed through ConfigParser -> Tokenizer, which calls eval() with a return; prefix intended to prevent code execution.
However, PHP hoists function and class declarations at compile time, even past a return statement. An attacker can define a class in the eval()'d code that hijacks a class loaded later via PHP's autoloader, achieving arbitrary code execution.
This vulnerability requires administrator access to the web UI (adm_config_set.php). The REST API's ConfigsSetCommand does NOT use Tokenizer/eval() and is not affected.
Impact
- Remote code execution as the web server user (www-data) from an authenticated administrator session
Patches
Workarounds
None.
Resources
Credits
McCaulay Hudson (@_McCaulay) of watchTowr
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 1.3.0 before 2.28.4
Fixed in 2.28.4
78 explicitly affected versions
2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 2.12.2, 2.13.0, 2.13.1, 2.13.2, 2.14.0, 2.15.0, 2.15.1, 2.16.0, 2.16.1, 2.17.0, 2.17.1, 2.17.2, 2.18.0, 2.18.1, 2.19.0, 2.19.1, 2.20.0, 2.20.1, 2.21.0, 2.21.1, 2.21.2, 2.21.3, 2.22.0, 2.22.1, 2.22.2, 2.23.0, 2.23.1, 2.24.0, 2.24.1, 2.24.2, 2.24.3, 2.24.4, 2.24.5, 2.25.0, 2.25.1, 2.25.2, 2.25.3, 2.25.4, 2.25.5, 2.25.6, 2.25.7, 2.25.8, 2.26.0, 2.26.1, 2.26.2, 2.26.3, 2.26.4, 2.27.0, 2.27.1, 2.27.2, 2.27.3, 2.28.0, 2.28.1, 2.28.2, 2.28.3, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.9.0, 2.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "2.28.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.10.0",
"2.10.1",
"2.11.0",
"2.11.1",
"2.12.0",
"2.12.1",
"2.12.2",
"2.13.0",
"2.13.1",
"2.13.2",
"2.14.0",
"2.15.0",
"2.15.1",
"2.16.0",
"2.16.1",
"2.17.0",
"2.17.1",
"2.17.2",
"2.18.0",
"2.18.1",
"2.19.0",
"2.19.1",
"2.20.0",
"2.20.1",
"2.21.0",
"2.21.1",
"2.21.2",
"2.21.3",
"2.22.0",
"2.22.1",
"2.22.2",
"2.23.0",
"2.23.1",
"2.24.0",
"2.24.1",
"2.24.2",
"2.24.3",
"2.24.4",
"2.24.5",
"2.25.0",
"2.25.1",
"2.25.2",
"2.25.3",
"2.25.4",
"2.25.5",
"2.25.6",
"2.25.7",
"2.25.8",
"2.26.0",
"2.26.1",
"2.26.2",
"2.26.3",
"2.26.4",
"2.27.0",
"2.27.1",
"2.27.2",
"2.27.3",
"2.28.0",
"2.28.1",
"2.28.2",
"2.28.3",
"2.3.0",
"2.3.1",
"2.3.2",
"2.3.3",
"2.4.0",
"2.4.1",
"2.4.2",
"2.5.0",
"2.5.1",
"2.5.2",
"2.6.0",
"2.7.0",
"2.7.1",
"2.8.0",
"2.8.1",
"2.9.0",
"2.9.1"
]
}