CVE-2024-34077
📋 TL;DR
MantisBT versions before 2.26.2 have an insufficient access control vulnerability in the registration and password reset process. An attacker can reset another user's password and take over their account if the victim has an incomplete password reset request pending. This affects all MantisBT installations using vulnerable versions.
💻 Affected Systems
- Mantis Bug Tracker (MantisBT)
📦 What is this software?
Mantisbt by Mantisbt
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full control of administrator or high-privilege accounts, leading to data theft, system compromise, or complete application takeover.
Likely Case
Attacker compromises regular user accounts to access sensitive project data, modify issues, or escalate privileges within the bug tracking system.
If Mitigated
With proper patching or workarounds, the attack window is eliminated or significantly reduced to minimal risk.
🎯 Exploit Status
Exploit involves brute-forcing user IDs against account_update.php endpoint while verification token is valid (5-minute window).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.26.2
Vendor Advisory: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
Restart Required: No
Instructions:
1. Backup your MantisBT installation and database. 2. Download MantisBT 2.26.2 or later from mantisbt.org. 3. Replace existing files with new version. 4. Run admin/check.php to verify installation. 5. Clear browser cache.
🔧 Temporary Workarounds
Reduce Token Expiry Time
allDecrease verification token validity period to reduce attack window
Edit constants_inc.php and change TOKEN_EXPIRY_AUTHENTICATED constant value to less than 300 seconds
🧯 If You Can't Patch
- Monitor account_update.php endpoint for unusual activity patterns
- Implement rate limiting or WAF rules to block brute-force attempts
🔍 How to Verify
Check if Vulnerable:
Check MantisBT version in config_inc.php or via admin/check.php - versions below 2.26.2 are vulnerableCheck Version:
grep 'g_mantis_version' config_inc.php || php admin/check.php | grep 'MantisBT Version'Verify Fix Applied:
Verify version is 2.26.2 or higher and test password reset functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed password reset attempts for different user IDs within short timeframe
- Unusual account_update.php requests with sequential user IDs
Network Indicators:
- HTTP POST requests to account_update.php with varying user_id parameters
SIEM Query:
source="mantisbt.log" AND "account_update.php" AND (user_id=* OR brute-force pattern)🔗 References
- https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
- https://mantisbt.org/bugs/view.php?id=34433
- https://github.com/mantisbt/mantisbt/commit/92d11a01b195a1b6717a2f205218089158ea6d00
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-93x3-m7pw-ppqm
- https://mantisbt.org/bugs/view.php?id=34433
