CVE-2024-34077: MantisBT Auth Bypass Vulnerability

CVE-2024-34077 Overview

CVE-2024-34077 is an access control flaw in MantisBT (Mantis Bug Tracker), an open source issue tracking application. The vulnerability resides in the registration and password reset workflow, where account_update.php fails to validate that the request belongs to the user who initiated the verification flow. An attacker can hijack a pending registration or password reset request and set a new password on the victim's account. Exploitation is constrained to the verification token's validity window of five minutes after the victim opens the confirmation URL, but attackers can brute-force account_update.php by iterating user IDs. Version 2.26.2 of MantisBT contains the patch.

Critical Impact
Successful exploitation grants full account takeover, exposing sensitive issue tracker data and any administrative functionality available to the compromised account.

Affected Products

MantisBT versions prior to 2.26.2
Self-hosted MantisBT instances with email-based account verification enabled
Deployments using the default TOKEN_EXPIRY_AUTHENTICATED constant value

Discovery Timeline

2024-05-14 - CVE-2024-34077 published to the National Vulnerability Database
2025-01-16 - Last updated in NVD database

Technical Details for CVE-2024-34077

Vulnerability Analysis

The flaw is a broken access control issue [CWE-305] in the account verification flow. When a new user registers or requests a password reset, MantisBT issues an email containing a confirmation URL. Opening that URL creates a short-lived TOKEN_ACCOUNT_VERIFY token valid for five minutes. During this window, account_update.php accepted the verify_user_id parameter without binding the request to the original confirmation hash. Any unauthenticated request supplying a valid verify_user_id could update the targeted account's password. Because user IDs are sequential integers, an attacker can script enumeration against account_update.php until a victim with an active verification token is found.

Root Cause

The pre-patch logic in account_update.php checked only whether a TOKEN_ACCOUNT_VERIFY token existed for the supplied verify_user_id. It did not require the requester to prove possession of the original confirm_hash value delivered via email. Authentication was effectively skipped whenever a verification token was present, so any external caller could ride a victim's pending verification.

Attack Vector

The attack is remote and unauthenticated. An attacker sends POST requests to account_update.php while iterating verify_user_id and supplying a new password. If a target user has an active verification token, the password update succeeds and the attacker obtains the account. No social interaction beyond the victim opening the original confirmation email is required.

php

# Patched logic in account_update.php (excerpt)
form_security_validate( 'account_update' );

$t_verify_user_id = gpc_get_int( 'verify_user_id', 0 );
$t_account_verification = (bool)$t_verify_user_id;
if( $t_account_verification ) {
	# Password reset request from verify.php - validate the confirmation hash
	$f_confirm_hash = gpc_get_string( 'confirm_hash' );
	$t_token_confirm_hash = token_get_value( TOKEN_ACCOUNT_ACTIVATION, $t_verify_user_id );
	if( $t_token_confirm_hash == null || $f_confirm_hash !== $t_token_confirm_hash ) {
		trigger_error( ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID, ERROR );
	}

	# Make sure the token is not expired
	if( null === token_get_value( TOKEN_ACCOUNT_VERIFY, $t_verify_user_id ) ) {
		trigger_error( ERROR_SESSION_NOT_VALID, ERROR );
	}

	# set a temporary cookie so the login information is passed between pages.
	auth_set_cookies( $t_verify_user_id );
	# fake login so the user can set their password
	auth_attempt_script_login( user_get_username( $t_verify_user_id ) );

Source: MantisBT commit 92d11a0. The patch now requires a matching confirm_hash value before allowing a verification-driven password update.

Detection Methods for CVE-2024-34077

Indicators of Compromise

High-volume POST requests to account_update.php with sequentially increasing verify_user_id values from a single source.
Successful password change events for accounts whose owners did not complete a reset workflow.
Login events from new IP addresses or geographies immediately following a password reset email open event.
Web server logs showing requests to account_update.php without a referrer from verify.php.

Detection Strategies

Correlate MantisBT application logs with web server access logs to find password updates that lack a preceding authenticated session.
Alert on more than a small number of distinct verify_user_id values seen from the same client IP within the five-minute token window.
Monitor outbound mail logs for password reset confirmations followed by account changes from unrelated IP addresses.

Monitoring Recommendations

Enable verbose authentication logging in MantisBT and forward logs to a centralized SIEM for retention and correlation.
Track baseline rates of password reset requests and alert on deviations.
Audit accounts with elevated privileges (administrators, project managers) for unexpected password change events.

How to Mitigate CVE-2024-34077

Immediate Actions Required

Upgrade all MantisBT instances to version 2.26.2 or later, which enforces confirm_hash validation in account_update.php.
Review authentication and account change logs for the period prior to patching and force password resets on any suspicious accounts.
Restrict network exposure of MantisBT administration endpoints to trusted networks where feasible.

Patch Information

The fix is delivered in MantisBT 2.26.2 via commit 92d11a01b195a1b6717a2f205218089158ea6d00. The patch adds confirm_hash parameter validation against the stored TOKEN_ACCOUNT_ACTIVATION token and explicit expiry checks for TOKEN_ACCOUNT_VERIFY. See the GitHub Security Advisory GHSA-93x3-m7pw-ppqm and MantisBT Bug Report #34433 for vendor details.

Workarounds

Reduce the TOKEN_EXPIRY_AUTHENTICATED constant value in constants_inc.php to shorten the exploitation window.
Place MantisBT behind a web application firewall and rate-limit POST requests to account_update.php.
Temporarily disable self-service password reset on internet-facing deployments until the upgrade is applied.

bash

# Example: shorten the verification token validity window in constants_inc.php
# Default is 300 seconds (5 minutes); reduce to 60 seconds as a temporary mitigation
sed -i "s/define( 'TOKEN_EXPIRY_AUTHENTICATED', 5 \* 60 );/define( 'TOKEN_EXPIRY_AUTHENTICATED', 60 );/" \
    /var/www/mantisbt/core/constants_inc.php