Jakub Galczyk discovered[1][2] a cross site scripting (XSS)
vulnerability in MantisBT 1.2.12 and earlier versions that allows a
malicious person to trick the browser of a target user into executing
arbitrary JavaScript via the URL: search.php?match_type="><script...
This vulnerability is particularly wide reaching due to search.php being
usable by anonymous users on public facing installations of MantisBT (no
user account required).
Patches against 1.2.x and master branches are attached and alternatively
available at [2].
References:
[1]http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html
[2] http://www.mantisbt.org/bugs/view.php?id=15373
The MantisBT project will release MantisBT 1.2.13 shortly and advise
popular Linux distributions packaging MantisBT to either apply the patch
or bump package versions to 1.2.13.
David Hicks
MantisBT Developer
#mantisbt irc.freenode.net
http://www.mantisbt.org/bugs/
Bcc: mantisbt-dev () lists sourceforge net
Attachment: master-1.2.x_0001-Fix-15373-match_type-XSS-vulnerability.patch
Description:
From bbc6b4f3ea8d0a53ae8c44e4218df6675a4e5fdf Mon Sep 17 00:00:00 2001
From: David Hicks <d () hx id au>
Date: Fri, 18 Jan 2013 21:43:21 +1100
Subject: [PATCH] Fix #15373: match_type XSS vulnerability
Jakub Galczyk discovered[1] a cross site scripting (XSS)
vulnerability in MantisBT 1.2.12 and earlier versions that allows a
malicious person to trick the browser of a target user into executing
arbitrary JavaScript via the URL: search.php?match_type="><script...
This vulnerability is particularly wide reaching due to search.php being
usable by anonymous users on public facing installations of MantisBT (no
user account required).
The value of the "match_type" filter parameter is now correctly
sanitised prior to use in the HTML output displaying the current filter
settings.
[1] http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html
---
core/filter_api.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/core/filter_api.php b/core/filter_api.php
index 2286ff0..ce2ca4f 100644
--- a/core/filter_api.php
+++ b/core/filter_api.php
@@ -3400,7 +3400,7 @@ function filter_draw_selection_area2( $p_page_number, $p_for_screen = true, $p_e
echo lang_get ('filter_match_all');
}
?>
-<input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE]?>"/>
+<input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>
</td>
<td colspan="6"> </td>
</tr>
--
1.8.1.1
Attachment: master_0001-Fix-15373-match_type-XSS-vulnerability.patch
Description:
From f5ac454eb63fde102347a021a2af0c535033d572 Mon Sep 17 00:00:00 2001
From: David Hicks <d () hx id au>
Date: Fri, 18 Jan 2013 21:43:21 +1100
Subject: [PATCH] Fix #15373: match_type XSS vulnerability
Jakub Galczyk discovered[1] a cross site scripting (XSS)
vulnerability in MantisBT 1.2.12 and earlier versions that allows a
malicious person to trick the browser of a target user into executing
arbitrary JavaScript via the URL: search.php?match_type="><script...
This vulnerability is particularly wide reaching due to search.php being
usable by anonymous users on public facing installations of MantisBT (no
user account required).
The value of the "match_type" filter parameter is now correctly
sanitised prior to use in the HTML output displaying the current filter
settings.
[1] http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html
---
core/filter_api.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/core/filter_api.php b/core/filter_api.php
index 37f6d04..e6b7c99 100644
--- a/core/filter_api.php
+++ b/core/filter_api.php
@@ -3395,7 +3395,7 @@ function filter_draw_selection_area2( $p_page_number, $p_for_screen = true, $p_e
echo lang_get ('filter_match_all');
}
?>
-<input type="hidden" name="match_type" value="<?php echo $t_filter[FILTER_PROPERTY_MATCH_TYPE]?>"/>
+<input type="hidden" name="match_type" value="<?php echo string_attribute( $t_filter[FILTER_PROPERTY_MATCH_TYPE] )?>"/>
</td>
<td colspan="6"> </td>
</tr>
--
1.8.1.1
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information