CVE-2020-12137

Vulnerability

GNU Mailman versions 2.x before 2.1.30, when processing email attachments with unknown or no file extension, scrubs the attachment and stores it in the list archive with a .obj extension [1]. Many web servers (e.g., Apache httpd) do not have a MIME type mapping for .obj in their default configuration, so they serve these files without a Content-Type header [1]. This allows browsers to perform MIME sniffing, potentially interpreting the file as text/html if it contains HTML, leading to reflected or stored XSS [1].

Exploitation

An attacker sends an email to a Mailman-managed mailing list with an attachment that contains arbitrary HTML and JavaScript, but with an unknown or no file extension (or simply any attachment that Mailman classifies as application/octet-stream) [1]. Mailman scrubs the attachment and stores it with a .obj extension in the public list archive [1]. When a visitor views the archived message and the web browser loads the .obj file, the server may not provide a MIME type, causing the browser to MIME-sniff the content. If the attachment content is HTML, JavaScript within it executes in the context of the archive domain [1]. No authentication is required to trigger the XSS; the attacker only needs the ability to post to the list (which may be open) [1].

Impact

An attacker can execute arbitrary JavaScript in the browser of any visitor viewing the list archive, leading to potential data theft, session hijacking, or defacement. The XSS is stored and affects all viewers of the archive, not just the attacker [1]. The scope is the web domain hosting the archive.

Mitigation

The issue is fixed in Mailman 2.1.30 [1][2]. Users should upgrade to 2.1.30 or later [1]. As a workaround, administrators can add a MIME type mapping for .obj in the web server configuration (e.g., application/octet-stream) to force a proper Content-Type header [1]. Note that Mailman 2.x is EOL and tied to Python 2, which is also EOL; migration to Mailman 3 is recommended [3]. Fedora has released updated packages [4].