HTML Injection in MailerUp Subscription Form

Executive Summary

This vulnerability is an HTML injection flaw in the MailerUp newsletter platform before version 1.1.3. It allows unauthenticated attackers to inject malicious HTML code into double opt-in verification emails by exploiting the first_name field in a subscription request. The injected HTML is then sent to an attacker-chosen email address using the form owner's configured sending identity.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your MailerUp instance is running a version prior to 1.1.3. Inspect the /subscribe/{form_id}/ endpoint for improperly escaped user input in the first_name field. Review email templates for unescaped HTML interpolation. Use network monitoring tools to detect suspicious POST requests to subscription endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this to send phishing emails that appear legitimate, track email opens via embedded images, or perform other actions when the email is opened. The emails would appear to come from a trusted domain with valid SPF/DKIM, increasing the chance of success.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data collection through tracking pixels, potential exposure of user data via phishing, and failure to protect user information. This may violate GDPR's data protection requirements and HIPAA's security rules for email communications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade MailerUp to version 1.1.3 or higher. Apply HTML escaping to all user-controlled fields in email templates. Review and sanitize input fields like first_name, title, and color before interpolation. Monitor for any unauthorized email activity or suspicious HTML injection attempts.

Useful 0 Not Useful 0