Roundup: [oss-security] Advisory: XSS in MantisBT Source Integration Plugin (CVE-2017-6958)

[grahamc]

Here is a report from the oss-security mailing list for Vulnerability Roundup 27.

Skip to First Email

Instructions:

Identification

Identify if we have the software, in 16.09, 17.03, and unstable. Then determine if we are vulnerable, and make a comment with your findings. It can also be helpful to specify if you think there is a patch, or if it can be fixed via a general update.

Example:

unstable: we are not vulnerable (link to the package)
17.03: we are vulnerable (link to the package)
16.09: we don't have it packaged

IMPORTANT: If you believe there are possibly related issues, bring them up on the parent issue!

Patching

Start by commenting on this issue saying you're working on a patch. This way, we don't duplicate work.

If you open a pull request, tag this issue and the master issue for the roundup.

If you commit the patch directly to a branch, please leave a comment on this issue with the branch and the commit hash, example:

fixed:

release-16.09: abc123

Skip to First Email

Upon Completion ...

• [ ] Update Graham's database

Info

Triage Indicator:

-needs-triage +roundup27 thread:0000000000004216

• File Search: https://search.nix.gsc.io/?q=source&i=fosho&repos=nixos-nixpkgs
• GitHub Search: https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=source+in%3Apath&type=Code

Should the search term be changed from source? Suggest a new package search by commenting:

-suggested:source +suggested:correctPackageName thread:0000000000004216

Known CVEs: CVE-2017-6958

---

Skip to End

Fri, 17 Mar 2017 09:08:39 +0100 Damien Regad <dregad-at-mantisbt.org>, CA+zp4VN23BSr2aCjrZohXM94UCFXdK8s5z81DLodSjbkDoMwUw@mail.gmail.com

A cross-site scripting (XSS) vulnerability in the MantisBT Source
Integration plugin search result page allows remote attackers to inject
arbitrary HTML or JavaScript (the latter, only if MantisBT's CSP settings
permit it) by crafting any valid parameter.

Affected versions: 2.0.0-beta.1 through 2.0.1
Fixed in versions: 2.0.2 (released 2017-03-16)

Patch:
https://github.com/mantisbt-plugins/source-integration/commit/b014da5687ec37c571105627bf090cb6f270ec35

Credits:
Reported by Dmitry Ivanov (d1m0ck) https://twitter.com/d1m0ck
Fixed by Damien Regad

References:
- Initial report http://openbugbounty.org/incidents/218993/
- Issue tracker https://github.com/mantisbt-plugins/source-integration/
issues/205
- Release
https://github.com/mantisbt-plugins/source-integration/releases/tag/v2.0.2

<http://www.mantisbt.org/bugs/view.php?id=22486>

Skip to End

---

[grahamc]

We have 1.2.19 across the board, I'm not sure if we're vulnerable.