Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in the SOAP API of MantisBT, an open-source bug tracking system. The issue allows an attacker to bypass authentication and impersonate any user, including administrators, by leveraging a valid cookie. This could expose sensitive project data and system access.
- Allows unauthorized user impersonation.
- Critical for data security and system integrity.
- Confirm if MantisBT SOAP API is in use.
Attack Path
How an attacker could exploit the issue
An attacker can bypass authentication in MantisBT's SOAP API by knowing a valid user's session cookie and their username. Since self-registration is enabled by default, an attacker can create an account, obtain their own session cookie, and then use it to impersonate any other user, including administrators, without needing their password. This allows the attacker to gain unauthorized access to sensitive information and system functions.
- Any user with a valid cookie can authenticate.
- Impersonate any user via the SOAP API.
- Unauthorized administrative access.
Live Threat
Current exploitation, exposure, and threat context
In default MantisBT installations, a user knowing a valid session cookie string could authenticate as any other user, including an administrator, via the SOAP API. This is possible when self-registration is enabled, allowing a newly registered user to leverage their own cookie to impersonate an administrator.
- Administrator account access.
- Cookie theft via browser.
- Unauthorized administrative actions.
Operational Fix
Recommended remediation, mitigation, and detection steps
Technical leaders and system owners should prioritize identifying all MantisBT installations, particularly those with exposed SOAP APIs and enabled self-registration, as these present the highest risk. Confirming the business criticality and identifying the accountable owner for each instance is crucial before planning remediation.
- Application or platform owners should manage the issue.
- Verify SOAP API exposure and self-registration status.
- Plan remediation during the next maintenance window.
