Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:31583
HistoryJan 02, 2015 - 12:00 a.m.

[KIS-2014-18] Mantis Bug Tracker <= 1.2.17 (ImportXml.php) PHP Code Injection Vulnerability

2015-01-0200:00:00
vulners.com
84

Mantis Bug Tracker <= 1.2.17 (ImportXml.php) PHP Code Injection Vulnerability

[-] Software Link:

http://www.mantisbt.org/

[-] Affected Versions:

All versions from 1.2.0 to 1.2.17.

[-] Vulnerability Description:

The vulnerable code is located in the /plugins/XmlImportExport/ImportXml.php script:

  1. printf( "Processing cross-references for %s issues…", count( $importedIssues ) );
  2. foreach( $importedIssues as $oldId => $newId ) {
  3.    $bugData = bug_get&#40; $newId, true &#41;;
    
  4.    $bugLinkRegexp = &#39;/&#40;^|[^&#92;w]&#41;&#40;&#39; . preg_quote&#40; $this-&gt;source_-&gt;issuelink, &#39;/&#39; &#41; . &#39;&#41;&#40;&#92;d+&#41;&#92;b/e&#39;;
    
  5.    $replacement = &#39;&quot;&#92;&#92;1&quot; . $this-&gt;getReplacementString&#40; &quot;&#92;&#92;2&quot;, &quot;&#92;&#92;3&quot; &#41;&#39;;
    
  6.    $bugData-&gt;description = preg_replace&#40; $bugLinkRegexp, $replacement, $bugData-&gt;description &#41;;
    
  7.    $bugData-&gt;update&#40; true, true &#41;;
    
  8. }

User input passed through the "description" field (and the "issuelink" attribute) of the uploaded XML
file when importing data through the Import/Export plugin is not properly sanitized before being used
in a "preg_replace()" call with the 'e' modifier at line 113. This can be exploited by unauthenticated
attackers to inject and execute arbitrary PHP code by uploading a specially crafted XML file. Successful
exploitation of this vulnerability requires the Import/Export plugin to be enabled (disabled by default).

[-] Solution:

Update to version 1.2.18.

[-] Disclosure Timeline:

[04/10/2014] - Issue reported to http://www.mantisbt.org/bugs/view.php?id=17725
[05/10/2014] - CVE number requested
[06/10/2014] - CVE number assigned
[01/11/2014] - Issue fixed on GitHub
[08/11/2014] - Public disclosure by the vendor on the OSS mailing list
[23/12/2014] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2014-7146 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2014-18