CVE-2025-55155

Executive Summary

CVE-2025-55155 is a medium-severity vulnerability in Mantis Bug Tracker (MantisBT), an open-source issue tracker. The flaw resides in the user profile editing functionality. When a user changes their email address, the application fails to verify that the new email address belongs to the user. This lack of validation can lead to two primary risks: (1) the user may enter an invalid email address, preventing them from receiving critical system notifications, and (2) if a user enters another person's email address, notifications intended for the original user could be sent to the wrong recipient, leading to potential information disclosure. The vulnerability is fixed in version 2.27.2.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby). However, MantisBT is a PHP application typically deployed via manual installation or Docker images. Organizations should verify the integrity of their MantisBT installation and ensure they are using the official source from the MantisBT GitHub repository or the official website. Supply chain risk is low, but users should avoid unofficial or modified distributions.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs a valid user account.
• User Interaction (UI): None (N) - No user interaction is required for exploitation.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure (email notifications).
• Integrity (I): None (N) - No data integrity impact.
• Availability (A): Low (L) - User may lose access to notifications.

Threat Level: Medium. Exploitation requires a valid user account, but the impact is limited to information disclosure and denial of notifications.

Deep Dive & Mechanics

The vulnerability is a classic case of improper input validation (CWE-20). In MantisBT versions 2.27.1 and below, the account_update.php or similar profile update endpoint does not perform server-side verification that the new email address is owned by the user. The typical flow is:

1. User logs in and navigates to their profile settings.
2. User changes the email address field to a new value.
3. User submits the form.
4. The server updates the user's email address in the database without sending a verification email or requiring confirmation.

The missing step is the email ownership verification. A secure implementation would send a confirmation link to the new email address and only update the record after the user clicks the link. Without this, an attacker with a valid account can:

• Set their email to an invalid address (e.g., user@nonexistentdomain.com), causing them to miss password reset emails, security alerts, or other notifications.
• Set their email to another user's email address (e.g., admin@example.com), causing notifications intended for the attacker to be sent to the admin, potentially leaking sensitive information about the attacker's activities.

Vulnerable vs. Patched Code

Vulnerable Code (MantisBT <= 2.27.1):

The vulnerable code is typically in core/user_api.php or account_update.php. The following is a simplified representation:

// Vulnerable: No email verification
function user_update_email($user_id, $new_email) {
    $query = "UPDATE mantis_user_table SET email = '$new_email' WHERE id = $user_id";
    db_query($query);
}

Patched Code (MantisBT 2.27.2):

The patched version adds a verification step. The email is not updated immediately; instead, a verification token is generated and sent to the new email address. The update only occurs after the token is confirmed.

// Patched: Email verification required
function user_update_email($user_id, $new_email) {
    // Generate a verification token
    $token = bin2hex(random_bytes(32));
    // Store token in a temporary table or session
    store_verification_token($user_id, $new_email, $token);
    // Send verification email
    send_verification_email($new_email, $token);
    // Do not update email yet
}

function confirm_email_change($user_id, $token) {
    $stored = get_verification_token($user_id);
    if (hash_equals($stored['token'], $token)) {
        $new_email = $stored['new_email'];
        $query = "UPDATE mantis_user_table SET email = '$new_email' WHERE id = $user_id";
        db_query($query);
        delete_verification_token($user_id);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on a MantisBT instance (version <= 2.27.1).
• Network access to the MantisBT web interface.

Exploitation Steps:

1. Log in to MantisBT with your valid credentials.
2. Navigate to your profile settings (e.g., https://target.com/mantisbt/account_page.php).
3. Change the email address to an invalid address (e.g., attacker@invalid.com) or to another user's email (e.g., admin@target.com).
4. Submit the form.
5. Observe that the email is updated immediately without any verification.

Impact:

• If you set an invalid email, you will no longer receive notifications (e.g., password reset emails). This can be used to lock yourself out of the account or to avoid detection.
• If you set another user's email, that user will receive notifications intended for you. This could leak information about your activities (e.g., issue updates, comments).

Lab Setup:

1. Deploy a vulnerable MantisBT instance using Docker:

   docker run -d -p 8080:80 --name mantisbt-vuln mantisbt/mantisbt:2.27.1
   

2. Access the web interface at http://localhost:8080.
3. Complete the installation wizard.
4. Create a test user account.
5. Log in as the test user and exploit the vulnerability as described above.

Blue Team

Detection:

• Monitor for rapid changes to user email addresses, especially if followed by password reset requests.
• Look for email addresses that are invalid or belong to known users (e.g., admin).
• Audit logs for profile update events.

Prevention:

• Upgrade to MantisBT 2.27.2 or later.
• If upgrade is not immediately possible, implement a web application firewall (WAF) rule to block requests that change email addresses without a verification step (though this is difficult to enforce at the WAF level).
• Enforce email verification at the application level by modifying the code (if you have access to the source).

Indicators of Compromise (IOCs)

• Log Entries: Look for account_update.php or account_update actions in web server logs with unusual email addresses.
• Database Changes: Check the mantis_user_table for email addresses that do not match the expected pattern (e.g., user@invalid.com).
• Network Traffic: Unusual email notifications being sent to unexpected recipients (e.g., admin receiving notifications for a regular user).

Detection Engineering

YARA Rule

rule CVE_2025_55155_MantisBT_Email_Validation {
    meta:
        description = "Detects vulnerable MantisBT code that lacks email verification on profile update"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55155"
        severity = "medium"
    strings:
        $vuln_func = "user_update_email" ascii wide nocase
        $vuln_query = "UPDATE mantis_user_table SET email" ascii wide nocase
        $no_verify = "email" ascii wide nocase
    condition:
        $vuln_func and $vuln_query and not $no_verify
}

Sigma Rule

title: CVE-2025-55155 - MantisBT Email Change Without Verification
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects when a user changes their email address in MantisBT without verification (vulnerable versions)
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55155
logsource:
    category: application
    product: mantisbt
detection:
    selection:
        EventID: "USER_UPDATE"
        TargetObject: "email"
        NewValue|re: "^[^@]+@[^@]+$"
    condition: selection
falsepositives:
    - Legitimate email changes in patched versions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55155 - MantisBT Email Change Without Verification"; flow:to_server; content:"POST"; http_method; content:"account_update.php"; http_uri; content:"email"; http_client_body; pcre:"/email=[^&]+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update MantisBT to version 2.27.2 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, consider disabling the profile editing feature temporarily or implementing a custom patch that adds email verification.

Long-Term Measures:

• Implement a security policy that requires email verification for all profile changes.
• Regularly audit user accounts for suspicious email addresses.
• Monitor logs for unusual profile update activity.

Patch Details:

• The fix is included in MantisBT version 2.27.2, released on [date]. The patch adds a verification step where a confirmation link is sent to the new email address before the change is applied.

Valters IT