MantisBT SOAP API has an authentication bypass vulnerability on MySQL

Root

Cause Versions of MantisBT prior to 2.28.1 running on MySQL family databases are vulnerable to an authentication bypass in the SOAP API. The issue stems from improper type checking on the password parameter in the mci_check_login() function [1]. MySQL performs implicit type conversion from string to integer, allowing crafted inputs to bypass authentication checks [4]. Other databases are unaffected as they do not perform such conversion.

Exploitation

An attacker who knows a victim's username can craft a malicious SOAP envelope to exploit the type conversion. By sending a specially crafted password value (e.g., a numeric string or empty string), the attacker can authenticate as the victim without knowing the actual password [1][4]. The attack requires access to the SOAP API endpoint; no other prerequisites are needed.

Impact

Successful exploitation allows the attacker to log in as any known user and execute any SOAP API function that the victim's account has access to. This includes the ability to retrieve sensitive user account information such as email addresses and real names [1][4]. The vulnerability can lead to unauthorized access to issue tracker data and functionality.

Mitigation

Version 2.28.1 contains a patch that adds proper type declarations to the mci_check_login() parameters, preventing the bypass [3]. As a workaround, disabling the SOAP API reduces the risk, but does not fully prevent the attacker from retrieving user account information via the SOAP API [4]. Users are strongly advised to upgrade to the patched version.