Bug 2026862 (CVE-2021-44227)

Summary:	CVE-2021-44227 mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover
Product:	[Other] Security Response	Reporter:	Riccardo Schirone <rschiron>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	extras-orphan, infra-sig, jkaluza, mosvald, ngompa13, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mailman 2.1.38	Doc Type:	---
Doc Text:	A Cross-Site Request Forgery (CSRF) attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right type of user when performing admin operations and a token created by a regular user can be used by an admin to perform an admin-level request, effectively bypassing the protection provided by CSRF tokens. A remote attacker with an account on the mailman system can use this flaw to perform a CSRF attack and perform operations on behalf of the victim admin.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-13 09:49:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2026866, 2026867, 2026868, 2026870, 2026871, 2026872, 2028499
Bug Blocks:	2026030

Description Riccardo Schirone 2021-11-26 09:52:00 UTC

A csrf_token value is not correctly checked against the right type of user when performing an admin operation. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover). Operations performed on the admin, admindb and edithtml pages should be validated only through CSRF tokens that are for the right type of user and not for every unprivileged user of mailman.

Comment 6 Riccardo Schirone 2021-12-02 14:10:29 UTC

Created mailman tracking bugs for this issue:

Affects: fedora-all [bug 2028499]

Comment 7 errata-xmlrpc 2021-12-02 16:16:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4916 https://access.redhat.com/errata/RHSA-2021:4916

Comment 8 errata-xmlrpc 2021-12-02 16:16:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2021:4915 https://access.redhat.com/errata/RHSA-2021:4915

Comment 9 errata-xmlrpc 2021-12-02 16:21:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:4913 https://access.redhat.com/errata/RHSA-2021:4913

Comment 10 errata-xmlrpc 2021-12-13 08:25:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2021:5081 https://access.redhat.com/errata/RHSA-2021:5081

Comment 11 errata-xmlrpc 2021-12-13 08:33:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:5080 https://access.redhat.com/errata/RHSA-2021:5080

Comment 12 Product Security DevOps Team 2021-12-13 09:49:06 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-44227