CVE-2020-12108

Vulnerability

The /options/mailman endpoint in GNU Mailman versions prior to 2.1.31 allows arbitrary content injection via the email POST parameter. This is similar to CVE-2018-13796 but at a different endpoint and parameter. The code path is reachable when an authenticated or unauthenticated user submits a specially crafted form to the options login page. [1], [2], [4]

Exploitation

An attacker can craft an HTML page that includes a form submission to the target Mailman server's /options/mailman endpoint. The form contains a hidden email field with arbitrary HTML and text, such as a phishing message. The victim only needs to open the attacker-supplied HTML page (e.g., via a phishing link) and click the submit button. The browser sends a POST request to the Mailman server, which then reflects the injected content back in the response. [4]

Impact

Successful exploitation allows an attacker to inject arbitrary content (such as phishing links or misleading messages) into the options login page response. This could trick users into disclosing credentials or other sensitive information. The attack is essentially a Content Injection vulnerability and has a medium severity according to the upstream bug report. [3], [4]

Mitigation

The vulnerability is fixed in GNU Mailman version 2.1.31, released on or around May 2020. Ubuntu issued security notice USN-4354-1 providing updated packages for affected Ubuntu releases. Users should upgrade to the latest version to mitigate the risk. No known workarounds exist for unpatched installations. [1], [3]