CVE-2025-62520

Executive Summary

CVE-2025-62520 is an information disclosure vulnerability in Mantis Bug Tracker (MantisBT), an open-source issue tracker. The flaw resides in the manage_config_columns_page.php script, where insufficient access-level checks allow any non-admin user with access to that page to use the "Copy From" action. This action enables the user to retrieve the column configuration from a private project they are not authorized to access. The vulnerability affects MantisBT versions 2.27.1 and below. The attack vector is network-based, requires low privileges, and no user interaction, but only results in low confidentiality impact. The official patch is available in version 2.27.2.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - The attacker needs a valid non-admin user account.
• User Interaction (UI): None (N) - No user action is required for exploitation.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure (column configuration).
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the confidentiality impact is low, the exposure of project column configurations can reveal sensitive metadata about private projects, potentially aiding further targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks (CWE-862). The manage_config_columns_page.php script is intended for administrators to manage the display columns for different projects. It includes a "Copy From" feature that allows copying column settings from one project to another.

The flaw is that the script does not verify whether the currently logged-in user has access to the source project when performing the "Copy From" action. A non-admin user with access to the configuration page (which is typically restricted, but the check is insufficient) can supply the ID of a private project they are not a member of. The script then retrieves and returns the column configuration for that private project, effectively leaking information about the project's structure and field visibility.

The exploitation is straightforward: an authenticated user sends a POST request to manage_config_columns_page.php with the copy_from parameter set to the ID of a private project. The server responds with the column configuration data for that project.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.27.1): The vulnerable code likely resides in manage_config_columns_page.php. The logic for the "Copy From" action does not include an access check for the source project.

// Vulnerable snippet (conceptual)
if( $f_copy_from ) {
    $t_project_id = $f_copy_from;
    // No access check for $t_project_id
    $t_columns = config_get( 'view_issues_columns', null, null, $t_project_id );
    // ... process and display columns
}

Patched Code (2.27.2): The patch adds an access check to ensure the user has access to the source project before copying its configuration.

// Patched snippet (conceptual)
if( $f_copy_from ) {
    $t_project_id = $f_copy_from;
    // Added access check
    access_ensure_project_level( config_get( 'manage_config_columns_threshold' ), $t_project_id );
    $t_columns = config_get( 'view_issues_columns', null, null, $t_project_id );
    // ... process and display columns
}

The key difference is the addition of access_ensure_project_level() which verifies the user has the required permission level for the source project.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid non-admin user account on a MantisBT instance (version <= 2.27.1).
• The ID of a private project to target (can be enumerated or guessed).

Exploitation Steps:

1. Authenticate: Log in to the MantisBT instance with the non-admin user account.

2. Identify Target Project ID: Use project listing or enumeration to find the ID of a private project (e.g., project ID 5).

3. Craft Request: Send a POST request to manage_config_columns_page.php with the copy_from parameter set to the target project ID.

   curl -X POST \
     'http://target-mantisbt.com/manage_config_columns_page.php' \
     -H 'Cookie: PHPSESSID=your_session_id' \
     -d 'copy_from=5'
   

4. Extract Data: The response will contain the column configuration for the private project, revealing field names and visibility settings.

Expected Output: The response will include HTML or JSON data showing the column configuration for the private project, such as:

view_issues_columns = array ( 'id', 'project_id', 'reporter_id', 'handler_id', 'priority', 'severity', 'status', 'resolution', 'last_updated', 'summary' )

Blue Team (Detection & Defense)

Detection:

• Monitor access logs for requests to manage_config_columns_page.php with a copy_from parameter from non-admin users.
• Look for patterns where a single user requests multiple different project IDs in quick succession.
• Alert on any access to manage_config_columns_page.php by users who do not have the manage_config_columns_threshold permission.

Defense:

• Immediate: Upgrade to MantisBT version 2.27.2 or later.
• Mitigation (if patching is delayed):
  • Restrict access to manage_config_columns_page.php using web server access controls (e.g., .htaccess or Nginx location block) to only allow admin IPs or users.
  • Implement a Web Application Firewall (WAF) rule to block requests to manage_config_columns_page.php with a copy_from parameter from non-admin users.
  • Monitor and audit user permissions regularly.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /manage_config_columns_page.php with parameter copy_from=<project_id>.
  • Repeated requests to the same endpoint with different copy_from values from the same user.
• Logs:
  • Access log entries showing POST /manage_config_columns_page.php with copy_from parameter.
  • Application logs showing config_get( 'view_issues_columns', ... ) calls for projects the user should not access.
• System:
  • Unusual column configuration changes in projects where the user is not a member.

Detection Engineering

YARA Rule

rule CVE_2025_62520_MantisBT_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-62520 in MantisBT"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-62520"
        severity = "medium"
    strings:
        $s1 = "manage_config_columns_page.php" ascii nocase
        $s2 = "copy_from" ascii nocase
        $s3 = "view_issues_columns" ascii nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-62520 - MantisBT Information Disclosure via Copy From
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-62520 in MantisBT by monitoring for requests to manage_config_columns_page.php with copy_from parameter.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62520
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'manage_config_columns_page.php'
        cs-uri-query|contains: 'copy_from='
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62520 - MantisBT Information Disclosure via Copy From"; flow:to_server,established; content:"POST"; http_method; content:"manage_config_columns_page.php"; http_uri; content:"copy_from="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Action:

• Upgrade: Update MantisBT to version 2.27.2 or later. This is the only complete fix.

Compensating Controls (if upgrade is not immediately possible):

• Access Control: Restrict access to manage_config_columns_page.php using web server configuration (e.g., Apache .htaccess or Nginx location block) to only allow administrative IP addresses or require additional authentication.
• WAF Rule: Deploy a Web Application Firewall rule to block POST requests to manage_config_columns_page.php containing the copy_from parameter from non-admin users.
• Monitoring: Enable detailed logging for manage_config_columns_page.php and set up alerts for any access by non-admin users.
• User Auditing: Review and minimize the number of users with access to the configuration page.

Long-Term Prevention:

• Implement a security-focused code review process for all authorization checks.
• Use automated static analysis tools to detect missing access controls.
• Follow the principle of least privilege for all user roles and permissions.

Valters IT