Mailman: cross-site scripting bug

Product: Mailman
Affected Version: 2.1 not other version has been tested
Vendor's URL: http://www.gnu.org/software/mailman/
Solution: TBC
Author: Manuel Rodriguez

Introduction:
------------
Mailman is software to help manage electronic mail discussion lists, much
like Majordomo or Smartmail. And Mailman have web interface systems.


Example:
-----------------
This is a simple example for version 2.1:

1) With mailman options the email variable is vulnerable to cross-site
scripting.

You can recognise the vulnerabilities with this type of URL:

https://www.yourserver.com:443/mailman/options/yourlist?
language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack') </SCRIPT>
and that prove that any (malicious) script code is possible on web
interface part of Mailman.

2) The default error page mailman generates does not adequately filter its
input making it susceptible to cross-site scripting.

https://www.yourserver.com:443//mailman/options/yourlist?
language=<SCRIPT>alert('Can%20Cross%20Site%20Attac k')</SCRIPT>

[Barry Warsaw]

In-Reply-To: <20030124143507.32126.qmail@mail.securityfocus.com>

A fix for this has now been posted. Please see the
xss-2.1.0-patch.txt file referenced here:

http://sourceforge.net/project/showfiles.php?group_id=103

This fix will be part of Mailman 2.1.1 when that
release is ready.

[Axel Beckert - ecos gmbh]

At Fri, Jan 24, 2003 at 12:32:37PM -0900, Leif Sawyer wrote:
> https://workserver//mailman/options/ak3barons?language=&lt;SCRIPT&gt;ale
> rt('Can%20Cross%20Site%20Attack')&lt;/SCRIPT&gt;
>
> returns:
>
> <h2>Error</h2><strong>Invalid options to CGI script.</strong>
>
> 2.0.11 doesn't seem to be vulnerable to this.

Same counts for 2.0.13 on Apache 1.3.27.

Kind regards, Axel Beckert
--
-------------------------------------------------------------
Axel Beckert ecos electronic communication services gmbh
Internetconnect * Webserver/-design/-datenbanken * Consulting

Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz
E-Mail: beckert@ecos.de Voice: +49 6133 939-220
WWW: http://www.ecos.de/ Fax: +49 6133 939-111
-------------------------------------------------------------