oss-security - mailman 2.x: XSS via file attachments in list archives

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 24 Feb 2020 15:34:51 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: mailman 2.x: XSS via file attachments in list archives

I have reported this quite a while ago and forgotten to properly
announce it.

In the mailman 2 mailing list manager there's a stored cross site
scripting vulnerability due to the way file attachments are handled.

Up to mailman 2.1.29 when sending a file without a file extension (or
an unknown file extension) then the file is stored in the list archive
with the file extension .obj.
Most web servers (e.g. apache httpd) will try to assign a mime type
based on the file extension and entries in /etc/mime.types.

In many Linux distributions (Debian, Fedora, Ubuntu) .obj is not
specified in /etc/mime.types. This means the web server will usually
send it out without a mime type.
The browser will then try to guess the MIME type based on the file's
content (MIME-sniffing). If the content is HTML then it will execute any
javascript contained.

I have reported this a while ago to mailman and they changed the
default from .obj to .bin. All distributions I tested assign
application/octet-stream to .bin files, which makes sure the browser
does not try to sniff the file type.
This change is in mailman 2.1.30rc1, but not in any stable release of
mailman.

I gave a talk discussing this type of vulnerability at last year's
SecurityFest conference:
https://www.youtube.com/watch?v=8t8JYpt0egE

Mitigating factors:
* Some web servers send a default mime type (e.g. nginx). This is
  generally a good way to prevent such vulnerabilities, although some
  people disagree [1]
* In Gentoo and Suse it is assigned to application/x-tgif, which is
  probably not what's intended here, but enough to prevent the
  vulnerability.
* Setting "X-Content-Type-Options: nosniff" will not prevent this
  vulnerability type in all browsers. The reason is that originally
  this header only applied to javascript and css content, not to HTML.
  Chrome still disables content sniffing for HTML, Firefox hopefully
  will soon.

[1] https://www.w3.org/2001/tag/doc/mime-respect.html
-- 
Hanno Böck
https://hboeck.de/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.