[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200224153451.4d773294@computer>
Date: Mon, 24 Feb 2020 15:34:51 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: mailman 2.x: XSS via file attachments in list archives
I have reported this quite a while ago and forgotten to properly
announce it.
In the mailman 2 mailing list manager there's a stored cross site
scripting vulnerability due to the way file attachments are handled.
Up to mailman 2.1.29 when sending a file without a file extension (or
an unknown file extension) then the file is stored in the list archive
with the file extension .obj.
Most web servers (e.g. apache httpd) will try to assign a mime type
based on the file extension and entries in /etc/mime.types.
In many Linux distributions (Debian, Fedora, Ubuntu) .obj is not
specified in /etc/mime.types. This means the web server will usually
send it out without a mime type.
The browser will then try to guess the MIME type based on the file's
content (MIME-sniffing). If the content is HTML then it will execute any
javascript contained.
I have reported this a while ago to mailman and they changed the
default from .obj to .bin. All distributions I tested assign
application/octet-stream to .bin files, which makes sure the browser
does not try to sniff the file type.
This change is in mailman 2.1.30rc1, but not in any stable release of
mailman.
I gave a talk discussing this type of vulnerability at last year's
SecurityFest conference:
https://www.youtube.com/watch?v=8t8JYpt0egE
Mitigating factors:
* Some web servers send a default mime type (e.g. nginx). This is
generally a good way to prevent such vulnerabilities, although some
people disagree [1]
* In Gentoo and Suse it is assigned to application/x-tgif, which is
probably not what's intended here, but enough to prevent the
vulnerability.
* Setting "X-Content-Type-Options: nosniff" will not prevent this
vulnerability type in all browsers. The reason is that originally
this header only applied to javascript and css content, not to HTML.
Chrome still disables content sniffing for HTML, Firefox hopefully
will soon.
[1] https://www.w3.org/2001/tag/doc/mime-respect.html
--
Hanno Böck
https://hboeck.de/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
