CVE-2014-8987 in MantisBT
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/13/2022
The vulnerability identified as CVE-2014-8987 represents a critical cross-site scripting flaw within the MantisBT bug tracking system, specifically affecting versions 1.2.13 through 1.2.17. This vulnerability exists in the Configuration Report page component, namely in the "set configuration" box functionality, making it accessible to remote administrators who can exploit the weakness to inject malicious web scripts or HTML content. The flaw stems from inadequate input validation and output sanitization within the adm_config_report.php file, where the config_option parameter fails to properly filter or escape user-supplied data before rendering it in the web interface.
The technical implementation of this vulnerability allows an attacker with administrative privileges to manipulate the configuration reporting interface by submitting malicious payloads through the config_option parameter. When the system processes this parameter without proper sanitization, the injected code becomes executable within the context of other users' browsers who view the configuration report page. This creates a persistent XSS vector that can be leveraged to steal session cookies, perform unauthorized actions on behalf of users, or redirect victims to malicious websites. The vulnerability operates at the application layer and specifically targets the web interface rendering mechanism rather than underlying system components.
The operational impact of CVE-2014-8987 extends beyond simple data theft or defacement, as it enables sophisticated attack chains that can compromise entire user sessions and potentially provide attackers with persistent access to the bug tracking system. Remote administrators with elevated privileges can craft malicious configurations that execute arbitrary scripts when other administrators view the configuration reports, creating a vector for privilege escalation and credential theft. The vulnerability's persistence stems from the fact that configuration data is often cached or stored in ways that make the malicious payloads active across multiple user sessions and page views.
Security mitigations for this vulnerability should focus on implementing comprehensive input validation and output encoding mechanisms within the affected MantisBT components. The recommended approach involves sanitizing all user-supplied input parameters, particularly those used in configuration contexts, through proper HTML escaping and context-appropriate encoding before any data is rendered in web pages. Additionally, implementing proper access controls and privilege separation can limit the damage scope, while regular security audits and code reviews should ensure that similar vulnerabilities do not exist in other input handling components. This vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in web applications, and could be mapped to ATT&CK technique T1566 for social engineering through malicious web content delivery. Organizations should prioritize immediate patching of affected versions and implement monitoring for suspicious configuration changes that might indicate exploitation attempts.