Executive Summary

This vulnerability in listmonk involves a failure to validate a nonce token included in HTTP requests, combined with the session cookie lacking a SameSite attribute. This allows attackers to perform a chained attack using Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). Attackers can craft malicious requests that authenticated users unknowingly execute, including submitting templates with embedded JavaScript code. When an admin previews these templates, the malicious code runs in their browser, enabling the attacker to create new admin accounts and take over the application. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a complete administrative takeover of the listmonk web application. Attackers can create new admin user accounts without authorization by exploiting the chained CSRF and XSS vulnerabilities, potentially compromising all administrative functions and data within the application. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves monitoring HTTP requests to the listmonk application for the presence of the 'nonce' parameter in requests alongside the 'session' cookie. Since the nonce is not validated, requests missing the nonce are processed correctly, which is unusual behavior. You can use tools like curl or browser developer tools to inspect requests. For example, use curl to send requests with and without the nonce parameter to see if the server processes them identically. Additionally, monitoring for suspicious POST requests to endpoints like '/api/templates/preview' or '/api/users' that may contain embedded JavaScript or unexpected JSON payloads can help detect exploitation attempts. Example command to test nonce behavior: curl -i -b 'session=your_session_cookie' -X POST https://your-listmonk-instance/api/templates/preview -d 'template=normal' and then repeat without the nonce parameter to compare responses. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the listmonk application to trusted networks or users, disabling or limiting the ability to create or preview templates via the '/api/templates/preview' endpoint, and monitoring for suspicious activity such as unexpected admin user creation. Since no patched versions are available, consider implementing web application firewall (WAF) rules to block CSRF and XSS attack patterns, and ensure that session cookies have the SameSite attribute set to prevent cross-origin requests from carrying authentication credentials. Additionally, educate users to avoid interacting with untrusted links or pages that could trigger CSRF attacks. [1]

Useful 0 Not Useful 0