CVE-2024-45792

Executive Summary

CVE-2024-45792 is an information disclosure vulnerability in Mantis Bug Tracker (MantisBT), an open-source issue tracker. An unprivileged, registered user can craft a POST request to retrieve sensitive information about other users' personal system profiles. This vulnerability is fixed in version 2.26.4. The exposure of system profile details could aid attackers in reconnaissance, potentially leading to targeted attacks.

Supply Chain & Package Security

MantisBT is a PHP-based application. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is a core application logic flaw. Users should verify the integrity of their MantisBT installation and ensure they are running the patched version.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) - requires a registered user account
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H) - exposes personal profile data
• Integrity (I): None (N)
• Availability (A): None (N)
• Base Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires authentication but allows a low-privileged user to access sensitive data of other users.

Deep Dive & Mechanics

The vulnerability exists in the way MantisBT handles POST requests for viewing or managing user profiles. An unprivileged user can manipulate the request parameters to access profile data belonging to other users. The application fails to properly validate that the requesting user has permission to view the target user's system profile.

The core issue is a lack of authorization checks on the server-side when processing profile-related POST requests. By crafting a request with a modified user ID or other identifier, an attacker can enumerate and retrieve profile details such as operating system, browser, and other system configuration data.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but the fix likely involves adding authorization checks before returning profile data.

Vulnerable Code (Conceptual):

// In a controller or API endpoint
$user_id = $_POST['user_id'];
$profile = get_profile($user_id);
echo json_encode($profile);

Patched Code (Conceptual):

// In a controller or API endpoint
$user_id = $_POST['user_id'];
if (!can_view_profile($current_user, $user_id)) {
    http_response_code(403);
    echo json_encode(['error' => 'Access denied']);
    exit;
}
$profile = get_profile($user_id);
echo json_encode($profile);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A registered user account on a vulnerable MantisBT instance (version < 2.26.4).
• Knowledge of another user's ID (can be enumerated).

Exploit Steps:

1. Log in to MantisBT with a low-privileged account.
2. Capture a legitimate POST request to a profile-related endpoint (e.g., profile_update.php or api/rest/profiles).
3. Modify the request parameters to target another user's ID.
4. Send the crafted POST request.
5. Observe the response containing the target user's system profile information.

Example cURL command:

curl -X POST https://target-mantisbt.com/api/rest/profiles \
  -H "Cookie: PHPSESSID=your_session_id" \
  -d "user_id=2&action=view"

Blue Team

Detection:

• Monitor for unusual POST requests to profile endpoints from low-privileged users.
• Look for requests where the user_id parameter differs from the authenticated user's ID.
• Alert on multiple failed attempts to access different user profiles.

Hunting:

• Search web server logs for POST requests to /api/rest/profiles or similar endpoints.
• Correlate requests with user session IDs to identify unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network: POST requests to /api/rest/profiles or /profile_update.php with a user_id parameter different from the authenticated user.
• Logs: Web server access logs showing 403 errors on profile endpoints from authenticated users.
• System: Unusual database queries fetching profile data for multiple users by a single low-privileged account.

Detection Engineering

YARA Rule

rule Detect_MantisBT_Profile_Enumeration {
    meta:
        description = "Detects attempts to exploit CVE-2024-45792 by looking for POST requests with user_id parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-45792"
    strings:
        $post_method = "POST"
        $profile_endpoint = "/api/rest/profiles" nocase
        $user_id_param = "user_id="
    condition:
        $post_method and $profile_endpoint and $user_id_param
}

Sigma Rule

title: MantisBT Profile Information Disclosure Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-45792 by monitoring for POST requests to profile endpoints with a user_id parameter
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/rest/profiles'
        cs-uri-query|contains: 'user_id='
    condition: selection
falsepositives:
    - Legitimate profile management by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"MantisBT Profile Information Disclosure Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/rest/profiles"; http_uri; content:"user_id="; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade MantisBT to version 2.26.4 or later.
• If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block POST requests to profile endpoints with a user_id parameter that does not match the authenticated user.

Long-term:

• Conduct a security audit of all API endpoints to ensure proper authorization checks.
• Implement role-based access control (RBAC) for all sensitive operations.
• Regularly update MantisBT to the latest version.

Valters IT