CVE-2019-15715

Root

Cause CVE-2019-15715 is a post-authentication command injection vulnerability in MantisBT. The issue stems from insufficient validation of user-supplied values for the neato_tool and dot_tool configuration settings. These settings control the paths to external tools (Graphviz utilities) used for rendering diagrams. An attacker with administrative privileges can modify these settings via the configuration management interface, injecting arbitrary commands that will be executed by the application [1][4].

Exploitation

To exploit this vulnerability, an attacker must have valid credentials with administrative-level access to the MantisBT instance. No other prerequisites are required; the attacker can simply navigate to the configuration page and set neato_tool or dot_tool to a malicious value (e.g., a command chain). When MantisBT subsequently invokes the tool (e.g., during diagram generation), the injected commands are executed on the server [4].

Impact

Successful exploitation leads to remote code execution (RCE) under the privileges of the web server user. This can allow the attacker to read, modify, or delete files, install backdoors, or pivot to other systems within the network. The vulnerability is rated with a CVSS score of 7.2 (High) per NVD [3].

Mitigation

MantisBT versions 1.3.20 and 2.22.1 have been released to fix this issue. The patch adds neato_tool and dot_tool to the list of global settings that cannot be modified via the database, thus preventing command injection through normal configuration channels [1][4]. Administrators should upgrade immediately or restrict administrative access to trusted users if upgrade is not possible.