CVE-2024-34080
📋 TL;DR
MantisBT versions before 2.26.2 have an information disclosure vulnerability where users can see metadata about notes they shouldn't have access to. When an issue references a note from another restricted issue, the hyperlink reveals the note's existence, author name, creation timestamp, and issue ID. This affects all MantisBT instances with multiple users and permission-based access controls.
💻 Affected Systems
- Mantis Bug Tracker (MantisBT)
📦 What is this software?
Mantisbt by Mantisbt
⚠️ Risk & Real-World Impact
Worst Case
An attacker could map internal issue IDs, identify active investigations, and potentially infer sensitive project details or personnel involvement through systematic enumeration of note metadata.
Likely Case
Internal users accidentally discover restricted note metadata while browsing accessible issues, potentially learning about confidential bug reports or security investigations they shouldn't know about.
If Mitigated
With proper access controls and monitoring, the impact is limited to metadata disclosure without actual note content, though it still violates least privilege principles.
🎯 Exploit Status
Exploitation requires authenticated access and involves clicking hyperlinks in issues that reference notes from restricted issues. No special tools or advanced techniques needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.26.2
Vendor Advisory: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q
Restart Required: No
Instructions:
1. Backup your MantisBT installation and database. 2. Download MantisBT 2.26.2 or later from mantisbt.org. 3. Replace existing files with new version (excluding config_inc.php and uploaded files). 4. Run admin/check.php to verify installation. 5. Clear browser cache if issues persist.
🧯 If You Can't Patch
- Implement strict access controls and user education about not sharing issue links containing note references.
- Monitor access logs for unusual patterns of issue navigation and implement additional logging for note metadata access attempts.
🔍 How to Verify
Check if Vulnerable:
Check if your MantisBT version is below 2.26.2 by viewing the version in the footer or running: grep -r "g_mantis_version" . | grep -v ".git"Check Version:
grep "\$g_mantis_version" config_defaults_inc.php | cut -d"'" -f2Verify Fix Applied:
After upgrading to 2.26.2 or later, create two issues with different access permissions, add a note to the restricted issue, reference it from the accessible issue, and verify the hyperlink no longer shows metadata.📡 Detection & Monitoring
Log Indicators:
- Multiple access denied errors for note access from same user
- Patterns of users accessing issues with note references to restricted issues
Network Indicators:
- HTTP requests to note.php endpoints returning 403 errors followed by continued browsing
SIEM Query:
source="mantisbt_access.log" (status=403 AND uri="*/note.php*") | stats count by src_ip, user🔗 References
- https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226
- https://github.com/mantisbt/mantisbt/pull/2000
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q
- https://mantisbt.org/bugs/view.php?id=34434
- https://github.com/mantisbt/mantisbt/commit/0a50562369d823689c9b946066d1e49d3c2df226
- https://github.com/mantisbt/mantisbt/pull/2000
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-99jc-wqmr-ff2q
- https://mantisbt.org/bugs/view.php?id=34434
