MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

Vulnerability

In MantisBT's tag_update_page.php, the value of the redirect is taken directly from the HTTP Referer header without HTML entity encoding [2]. The vulnerable code at line 106 assigns $t_redirect_page from basename( $_SERVER["HTTP_REFERER"] ) and then outputs it unsanitized into a hidden input field: <input type="hidden" name="redirect" value="<?php echo $t_redirect_page ?>"/>` [2][4]. This improper escaping allows an attacker to inject arbitrary HTML into the page [1][3].

Exploitation

Exploitation

Modern browsers automatically URL-encode special characters in the Referer header, so a direct reflected XSS attack is not feasible under normal conditions [2]. However, if the server uses a caching layer such as Varnish Cache, or if the front-end and back-end are vulnerable to HTTP request smuggling, the injected payload can be stored in the cache [2][3]. A subsequent request from a victim would then receive the poisoned cached response, executing the attacker's script [2][3].

Impact

Successful exploitation leads to cross-site scripting (XSS) in the victim's browser [1][3]. An attacker could steal session cookies, perform actions on behalf of the authenticated user, or deface the application.

Mitigation

The issue is fixed in commit b1ebc57763f104eb5f541b7b4d1ce6948168abd9, which wraps the output with string_html_specialchars() [4]. No workarounds are available; users must apply the patch [1][3].