Cloudanix VulnDB

CVE-2021-42097

High · 8.0

CVSS

8.0

EPSS

1.3%

Published

Oct 21, 2021

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A problem in mailing list software lets attackers steal admin control by tricking logged-in administrators into clicking a link that uses a reusable security token.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
Application
Class
CSRF
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The CSRF token is generated without binding to a specific user session or account, allowing a token obtained by a low-privileged user to be replayed in requests that perform administrative actions such as account takeover.

Why it matters to the business

Attackers can gain administrative control of mailing list servers, enabling unauthorized changes to subscriber data, list configurations, and potential further compromise of connected systems; urgent patching is required given the age of the flaw and its presence in widely deployed distributions.

How an attack unfolds

An attacker creates or compromises an unprivileged account, extracts the reusable csrf_token value, crafts a malicious request containing that token, and delivers it to an administrator (for example via a crafted link or page) so that the administrator's browser performs the privileged action while authenticated.

How to fix it

Upgrade GNU Mailman to version 2.1.35 or later on all affected instances; Debian users should apply the corresponding security update for their distribution release.

How to confirm the fix worked

Confirm the installed Mailman version is 2.1.35 or newer; review server configuration and logs for any remaining instances of the vulnerable package; test that administrative actions now require fresh, user-specific tokens.

Typical attack path

  1. Obtain or create a low-privileged Mailman account
  2. Trigger generation of a csrf_token under that account
  3. Capture the token value
  4. Craft a CSRF payload that targets an administrative function such as password change or role escalation
  5. Deliver the payload to an administrator who is currently authenticated
  6. Administrator's browser submits the request, completing the privilege escalation

How to detect it

Review Mailman access and error logs for administrative actions performed from unexpected IP addresses or user accounts; look for repeated use of the same csrf_token value across different sessions; correlate with web server logs showing POST requests to admin endpoints without corresponding user login events.

What your security team should do

  • Immediately upgrade all Mailman installations to 2.1.35 or later
  • Audit administrator accounts for unauthorized changes since the vulnerability was disclosed
  • Restrict administrative access to trusted networks until patching is complete
  • Monitor for unexpected administrative actions in Mailman logs

The record

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 mailman 0 3:2.1.29-12.module_el8.5.0+26+48d4c9ee.2
AlmaLinux:8 mailman 0 3:2.1.29-12.module_el8.5.0+2601+e8845b76.1
AlmaLinux:8 mailman 0 3:2.1.29-12.module_el8.5.0+2602+327eb9f3.2
Debian:10 mailman 0 1:2.1.29-1+deb10u2
Debian:9 mailman 0 1:2.1.23-1+deb9u7
Red Hat:enterprise_linux:7::server mailman 0 3:2.1.15-30.el7_9.2
Red Hat:enterprise_linux:7::server mailman-debuginfo 0 3:2.1.15-30.el7_9.2
Red Hat:enterprise_linux:7::workstation mailman 0 3:2.1.15-30.el7_9.2
Red Hat:enterprise_linux:7::workstation mailman-debuginfo 0 3:2.1.15-30.el7_9.2
Red Hat:enterprise_linux:8::appstream mailman 0 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1
Red Hat:enterprise_linux:8::appstream mailman-debuginfo 0 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1
Red Hat:enterprise_linux:8::appstream mailman-debugsource 0 3:2.1.29-12.module+el8.5.0+13211+e8845b76.1
Red Hat:rhel_eus:8.1::appstream mailman 0 3:2.1.29-4.module+el8.1.0+13242+45286865.1
Red Hat:rhel_eus:8.1::appstream mailman-debuginfo 0 3:2.1.29-4.module+el8.1.0+13242+45286865.1
Red Hat:rhel_eus:8.1::appstream mailman-debugsource 0 3:2.1.29-4.module+el8.1.0+13242+45286865.1
Red Hat:rhel_eus:8.2::appstream mailman 0 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3
Red Hat:rhel_eus:8.2::appstream mailman-debuginfo 0 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3
Red Hat:rhel_eus:8.2::appstream mailman-debugsource 0 3:2.1.29-4.module+el8.2.0+13241+705a6aa4.3
Red Hat:rhel_eus:8.4::appstream mailman 0 3:2.1.29-11.module+el8.4.0+13212+81332387.1
Red Hat:rhel_eus:8.4::appstream mailman-debuginfo 0 3:2.1.29-11.module+el8.4.0+13212+81332387.1
Red Hat:rhel_eus:8.4::appstream mailman-debugsource 0 3:2.1.29-11.module+el8.4.0+13212+81332387.1
Rocky Linux:8 mailman 0 3:2.1.29-12.module+el8.5.0+717+27fd1ba7.2
SUSE:Package Hub 15 SP2 mailman 0 2.1.35-bp152.7.6.1
Ubuntu:18.04:LTS mailman 0 1:2.1.26-1ubuntu0.4
Ubuntu:20.04:LTS mailman 0 1:2.1.29-1ubuntu3.1
Ubuntu:Pro:16.04:LTS mailman 0 1:2.1.20-1ubuntu0.6+esm1
openSUSE:Leap 15.2 mailman 0 2.1.35-lp152.7.6.1

Related vulnerabilities