CVE-2015-1042 in MantisBT
Summary
by MITRE
The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/16/2022
The vulnerability CVE-2015-1042 affects MantisBT versions 1.2.0a3 through 1.2.18 and resides in the string_sanitize_url function within core/string_api.php. This flaw represents a classic input validation issue that enables attackers to manipulate URL parameters and potentially redirect users to malicious destinations. The vulnerability specifically targets the return parameter in login_page.php, where a malformed URL containing a ":/" separator can bypass intended security checks.
The technical root cause stems from an incorrect regular expression implementation that fails to properly validate URL formats. When users are redirected to the login page with a return parameter containing a colon-slash sequence, the flawed sanitization routine does not adequately filter or validate the input, allowing malicious URLs to pass through undetected. This improper validation creates an open redirect vulnerability that can be exploited by attackers to craft deceptive links. The vulnerability differs from CVE-2014-6316 in its specific implementation and attack vector, though both relate to URL handling flaws in the authentication process.
The operational impact of this vulnerability is significant as it enables man-in-the-middle attacks and phishing campaigns. Attackers can construct malicious URLs that appear legitimate to users but redirect them to attacker-controlled domains. This opens doors for credential theft, malware distribution, and social engineering attacks. Users who click on compromised links may be redirected to fake login pages that mimic the legitimate MantisBT interface, leading to unauthorized access to sensitive project data and user credentials. The vulnerability particularly affects organizations relying on MantisBT for issue tracking and project management where user authentication is critical.
Organizations should immediately upgrade to MantisBT version 1.2.19 or later, which contains the patched string_sanitize_url function with corrected regular expression validation. Network administrators should implement URL filtering and monitoring to detect suspicious redirect patterns. Security teams should conduct thorough vulnerability assessments of all web applications using similar URL validation mechanisms. The vulnerability aligns with CWE-601 Open Redirect and ATT&CK technique T1566 Phishing, highlighting the need for proper input validation and secure coding practices. Additionally, implementing proper HTTP headers such as Content Security Policy can provide additional defense-in-depth measures against such redirect-based attacks.