Attack Chain

1. An attacker with appropriate privileges logs into a vulnerable MantisBT instance.
2. The attacker creates a new tag with a malicious payload embedded in the tag name (e.g., <img src=x onerror=alert(1)>).
3. The attacker associates the malicious tag with an issue.
4. The attacker renames the malicious tag, further storing the payload in the history.
5. A user views the issue's timeline on my_view_page.php.
6. The application retrieves the tag name from the history without proper escaping.
7. The malicious HTML is rendered in the user's browser.
8. If CSP allows, the injected JavaScript executes, leading to XSS.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other MantisBT users' browsers. This can lead to sensitive information disclosure, such as session cookies, which can then be used to hijack user accounts. The impact could also include defacement of the MantisBT interface or redirection of users to malicious websites. The vulnerability affects MantisBT 2.28.0 and requires immediate patching or mitigation.

Recommendation

• Upgrade to a patched version of MantisBT that includes the fix f32787c14d4518476fe7f05f992dbfe6eaccd815.
• Apply the suggested workaround by wrapping $this->tag_name in a string_html_specialchars() call in IssueTagTimelineEvent::html().
• Deploy the Sigma rule "MantisBT Tag Based XSS Attempt" to detect potential exploitation attempts within web server logs.
• Monitor web server logs for requests to my_view_page.php containing suspicious tag names with HTML entities as detected by the Sigma rule "MantisBT Suspicious Tag".