Package Instance

MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API
### Impact
MantisBT allows an authenticated user to upload attachments to private Issues they are not authorized to access.

### Patches
- b262b4d2835b81394d75356dead66e52a6275206

### Workarounds
None.

### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
Improper escaping of a textarea custom field's contents in the Update Issue page (bug_update_page.php) allows an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded.

### Impact
Session theft leading to admin account takeover, full project data access.

- Precondition: A textarea-type custom field must be configured for the project
- Attacker: Authenticated user with bug report permission (low privilege)
- Victim: Any user viewing the bug edit form, including administrators

### Patches
- 5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7

### Workarounds
The default Content-Security Policy will block script execution.

### References
- https://mantisbt.org/bugs/view.php?id=37003
- This is related to [CVE-2024-34081](https://github.com/advisories/GHSA-wgx7-jp56-65mq).

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue, and providing a patch to fix it.
- Thanks to Nozomu Sasaki (Paul) (@morimori-dev)
- Tristan Madani (@TristanInSec) from Talence Security

MantisBT Vulnerable to Privilege Escalation from Manager to Administrator
Insufficient access control checks in _ProjectUsersAddCommand_ (used in *manage_proj_user_add.php* and REST API endpoint `PUT /project/{id}/users`) allows users having *manage_project_threshold* access level (*manager* by default) to grant project-level *administrator* access to any user (including themselves) in any Project they have *manager* rights in.

The normal project-user add form does restrict the selectable access levels to the actor's own project role or below. However, the backend handler still accepts a forged higher access_level value and writes it.

### Impact
Privilege escalation.

The consequences of the privilege escalation are not as bad as it may sound, because having *administrator* access at Project level is effectively not very different from being *manager*, it does not actually give administrator privileges on the whole MantisBT instance. In particular, it does not let the upgraded user delete the Project or grant them any access to global administrative functions such as managing Users, Projects, Plugins, Custom Fields, etc. 

### Patches
- 69e0180f180ed5acf48a8d281a73683a7bf32461

### Workarounds
None

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue:
- [Dracosec Research Limited](https://dracosec.tech/) (Siu Nam Tang, Chris Chan, Krecendo Hui, William Lam)
- Vishal Shukla

MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject HTML.

While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting.

### Impact
Cross-site scripting (XSS).

### Patches
- b1ebc57763f104eb5f541b7b4d1ce6948168abd9

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue
MantisBT permits a user to list and download their own attachments from an Issue created by another user, even after that Issue becomes private and direct access to it is denied.

### Impact
The loss of confidentiality caused by this vulnerability is minimal, considering that only the attachments that were previously uploaded by the user themselves remains accessible.

### Patches
- de7bdeec36de066235e38a77bf056917d951c84d

### Workarounds
None.

### Credits

Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue.

### Impact
Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure.

### Patches
- 71df1f67e05b2050cd4bd87839e6cc13747cf03f

### Workarounds
None

### Credits 
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

MantisBT has a Private Bugnote Attachment Content Leak via REST API
A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint.

### Impact
- REPORTER (access level 25) can view file attachments that were uploaded to private bugnotes by DEVELOPER/MANAGER/ADMIN users
- Private bugnotes are intended for internal developer discussion; their attachments (logs, screenshots, patches) should be equally protected
- The web UI is NOT affected — it filters through bugnote_get_all_visible_bugnotes() first

### Patches
- 029d9d203d9e4ae96b3e59d552fa7395cc1e5071

### Workarounds
None

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue.
- Vishal Shukla 
- Tristan Madani (@TristanInSec) from Talence Security 
- Tang Cheuk Hei (@siunam321) 

This advisory's contents was largely copied from Tristan's well-written report.

MantisBT has Stored XSS on Move Attachments Admin Page
Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page.

### Impact
Cross-site scripting (XSS).
This is mitigated by Content Security Policy which restricts scripts execution.

### Patches
- 5cb4b469295889f5d2b01677c9bf82c143e0fdaa

### Workarounds
None

MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form
When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before the category selector without proper escaping, allowing an attacker able to to inject HTML if they can set the Project's name (which typically requires *manager* or *administrator* access level).


### Impact
Cross-site scripting (XSS).
This is mitigated by Content Security Policy which restricts scripts execution.

### Patches
- df22697ae497ddd93f3d9132fdf4979db8d081cd

### Workarounds
Make sure Project names do not contain any HTML tags.

### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

The vulnerability was also identified and independently reported by @siunam321 (Tang Cheuk Hei), prior to this Advisory's publication.

MantisBT has an authorization bypass in private issue monitoring
Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue.


### Impact
Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content.

### Patches
- 0a93267deba445fb9d15250c16e6fdb1246ffa65

### Workarounds
None

### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
Any authenticated user can inject arbitrary HTML via updating their account's font family.

### Impact
Cross-site scripting.
The injected payload will be reflected in every MantisBT page.

Leveraging another vulnerability (CSP bypass, see [GHSA-9c3j-xm6v-j7j3](https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3)), the attacker could achieve account takeover.

### Patches
- 9e8409cdd979eba86ef532756fc47c1d8112d22d

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline
Improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.

### Impact
Cross-site scripting (XSS).

### Patches
f32787c14d4518476fe7f05f992dbfe6eaccd815

### Workarounds
* Edit offending History entries (using SQL)
* Wrap `$this->tag_name` in a string_html_specialchars() call in IssueTagTimelineEvent::html()

### Credits
MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

MantisBT Vulnerable to Stored XSS in File Download
Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

### Impact
Cross-site scripting

### Patches
- 26647b2e68ba30b9d7987d4e03d7a16416684bc2

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

MantisBT has a Content Security Policy bypass via attachments
Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-src_ directive by uploading a crafted attachment to any issue that, when accessed via the _file_download.php_ link, will be downloaded with a valid JavaScript MIME type resulting in script execution.

The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a `<script>` tag by the browser, due to response header X-Content-Type-Options being set to _nosniff_, which requires all imported JavaScript files to be a valid JavaScript MIME type.

### Impact
Cross-site scripting

### Patches
- 9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe

### Workarounds
None

### Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
The mc_issue_update() function in MantisBT allows users having *update_bug_threshold* access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function.

### Impact
1. UPDATER can edit notes by DEVELOPER/MANAGER/ADMIN — bypassing the DEVELOPER threshold
2. UPDATER can change private notes to public — exposing confidential internal discussion
3. UPDATER can change public notes to private — hiding information from reporters/viewers

### Patches
- 6e58fae4f22efdc3987f903c8ba2611de17a9435

### Workarounds
None

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue.
- Vishal Shukla 
- Tristan Madani (@TristanInSec) from Talence Security 

This advisory's contents was largely copied from Tristan's well-written report.