CVE-2021-40347

Vulnerability

The issue exists in views/list.py of GNU Mailman Postorius before version 1.3.5 [1]. The ListUnsubscribeView does not verify that the authenticated user owns the email address they are requesting to unsubscribe [2]. As a result, any logged-in user can craft a POST request to unsubscribe any email address from any mailing list [4].

Exploitation

An attacker must be logged into any account on the Postorius instance [1]. They can then send a crafted POST request to the unsubscribe/ endpoint, altering the form fields (e.g., changing the URL from subscribe to unsubscribe/, setting the email parameter to the target address) [4]. No special privileges or user interaction beyond authentication are required.

Impact

Successful exploitation allows the attacker to unsubscribe any user from any mailing list, causing denial of service or unauthorized removal [1][4]. Additionally, the response indicates whether the target address was subscribed, leaking membership information [2][4].

Mitigation

The vulnerability is fixed in Postorius version 1.3.5, released on September 5, 2021 [3]. The fix adds validation that the requesting user owns the email address being unsubscribed [2]. Users should upgrade to 1.3.5 or later. No workaround is documented.