CVE-2014-8598: MantisBT XML Import/Export plugin unrestricted access

[Damien Regad <dregad () mantisbt org>]

Mitre assigned CVE-2014-8598 to this issue.

Description:

The XML Import/Export "official" plugin (i.e. bundled with MantisBT 
releases) currently does not perform any access level checks in the 
import and export pages. This leads to the following vulnerabilities:

1) import

Any user of a MantisBT instance with the XML plugin enabled and knowing 
the URL to the plugin's import page could upload an XML file and insert 
data without restriction, regardless of their access level.

This vulnerability is particularly dangerous when used in combination 
with the one described in issue #17725 [1] (CVE-2014-7146) as it makes 
for a very simple and easily accessible vector for PHP code injection 
attacks.

2) export

There was also no access check when exporting data, which could allow an 
attacker to gain access to confidential information (disclosure of all 
bug-related data, including usernames).

Systems where the patch described below cannot be applied are strongly 
advised to uninstall the plugin.


Affected versions:
> = 1.2.0a3, <= 1.2.17

Fixed in versions:
1.2.18 (not yet released)

Patch:
See Github [3]

Credit:
Issue was discovered and fixed by Damien Regad (MantisBT Developer)

References:
Further details available in our issue tracker [2]


[1] http://www.mantisbt.org/bugs/view.php?id=17725
[2] http://www.mantisbt.org/bugs/view.php?id=17780
[3] https://github.com/mantisbt/mantisbt/commit/80a15487