Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create a list or (2) insert cross-site scripting (XSS) sequences. NOTE: this issue exists because of an incomplete fix for CVE-2011-0748. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Weakness
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Phplist | Tincan | * | 2.10.13 (including) |
| Phplist | Tincan | 1.0 (including) | 1.0 (including) |
| Phplist | Tincan | 1.0.1 (including) | 1.0.1 (including) |
| Phplist | Tincan | 1.1.2b (including) | 1.1.2b (including) |
| Phplist | Tincan | 1.1.3b (including) | 1.1.3b (including) |
| Phplist | Tincan | 1.1.4b (including) | 1.1.4b (including) |
| Phplist | Tincan | 1.1.5 (including) | 1.1.5 (including) |
| Phplist | Tincan | 1.1.5b (including) | 1.1.5b (including) |
| Phplist | Tincan | 1.1.6 (including) | 1.1.6 (including) |
| Phplist | Tincan | 1.1.7 (including) | 1.1.7 (including) |
| Phplist | Tincan | 1.3.5 (including) | 1.3.5 (including) |
| Phplist | Tincan | 1.3.7 (including) | 1.3.7 (including) |
| Phplist | Tincan | 1.4.1 (including) | 1.4.1 (including) |
| Phplist | Tincan | 1.5.0 (including) | 1.5.0 (including) |
| Phplist | Tincan | 1.5.1 (including) | 1.5.1 (including) |
| Phplist | Tincan | 1.6.0 (including) | 1.6.0 (including) |
| Phplist | Tincan | 1.6.1 (including) | 1.6.1 (including) |
| Phplist | Tincan | 1.6.3 (including) | 1.6.3 (including) |
| Phplist | Tincan | 1.6.4 (including) | 1.6.4 (including) |
| Phplist | Tincan | 1.7.0 (including) | 1.7.0 (including) |
| Phplist | Tincan | 1.7.1 (including) | 1.7.1 (including) |
| Phplist | Tincan | 1.8.0 (including) | 1.8.0 (including) |
| Phplist | Tincan | 1.9.0 (including) | 1.9.0 (including) |
| Phplist | Tincan | 1.9.1 (including) | 1.9.1 (including) |
| Phplist | Tincan | 1.9.2 (including) | 1.9.2 (including) |
| Phplist | Tincan | 1.9.3 (including) | 1.9.3 (including) |
| Phplist | Tincan | 2.1.0 (including) | 2.1.0 (including) |
| Phplist | Tincan | 2.1.1 (including) | 2.1.1 (including) |
| Phplist | Tincan | 2.1.3 (including) | 2.1.3 (including) |
| Phplist | Tincan | 2.1.4 (including) | 2.1.4 (including) |
| Phplist | Tincan | 2.2.0 (including) | 2.2.0 (including) |
| Phplist | Tincan | 2.2.1 (including) | 2.2.1 (including) |
| Phplist | Tincan | 2.3.0 (including) | 2.3.0 (including) |
| Phplist | Tincan | 2.3.1 (including) | 2.3.1 (including) |
| Phplist | Tincan | 2.3.2 (including) | 2.3.2 (including) |
| Phplist | Tincan | 2.3.3 (including) | 2.3.3 (including) |
| Phplist | Tincan | 2.3.4 (including) | 2.3.4 (including) |
| Phplist | Tincan | 2.4.0 (including) | 2.4.0 (including) |
| Phplist | Tincan | 2.4.7 (including) | 2.4.7 (including) |
| Phplist | Tincan | 2.5.0 (including) | 2.5.0 (including) |
| Phplist | Tincan | 2.5.1 (including) | 2.5.1 (including) |
| Phplist | Tincan | 2.5.2 (including) | 2.5.2 (including) |
| Phplist | Tincan | 2.5.3 (including) | 2.5.3 (including) |
| Phplist | Tincan | 2.5.4 (including) | 2.5.4 (including) |
| Phplist | Tincan | 2.5.5 (including) | 2.5.5 (including) |
| Phplist | Tincan | 2.5.6 (including) | 2.5.6 (including) |
| Phplist | Tincan | 2.5.7 (including) | 2.5.7 (including) |
| Phplist | Tincan | 2.5.8 (including) | 2.5.8 (including) |
| Phplist | Tincan | 2.6 (including) | 2.6 (including) |
| Phplist | Tincan | 2.6.0 (including) | 2.6.0 (including) |
| Phplist | Tincan | 2.6.1 (including) | 2.6.1 (including) |
| Phplist | Tincan | 2.6.2 (including) | 2.6.2 (including) |
| Phplist | Tincan | 2.6.3 (including) | 2.6.3 (including) |
| Phplist | Tincan | 2.6.4 (including) | 2.6.4 (including) |
| Phplist | Tincan | 2.6.5 (including) | 2.6.5 (including) |
| Phplist | Tincan | 2.7.1 (including) | 2.7.1 (including) |
| Phplist | Tincan | 2.7.2 (including) | 2.7.2 (including) |
| Phplist | Tincan | 2.8.2 (including) | 2.8.2 (including) |
| Phplist | Tincan | 2.8.7 (including) | 2.8.7 (including) |
| Phplist | Tincan | 2.8.12 (including) | 2.8.12 (including) |
| Phplist | Tincan | 2.9.3 (including) | 2.9.3 (including) |
| Phplist | Tincan | 2.9.4 (including) | 2.9.4 (including) |
| Phplist | Tincan | 2.9.5 (including) | 2.9.5 (including) |
| Phplist | Tincan | 2.10.1 (including) | 2.10.1 (including) |
| Phplist | Tincan | 2.10.2 (including) | 2.10.2 (including) |
| Phplist | Tincan | 2.10.3 (including) | 2.10.3 (including) |
| Phplist | Tincan | 2.10.4 (including) | 2.10.4 (including) |
| Phplist | Tincan | 2.10.5 (including) | 2.10.5 (including) |
| Phplist | Tincan | 2.10.6 (including) | 2.10.6 (including) |
| Phplist | Tincan | 2.10.7 (including) | 2.10.7 (including) |
| Phplist | Tincan | 2.10.8 (including) | 2.10.8 (including) |
| Phplist | Tincan | 2.10.9 (including) | 2.10.9 (including) |
| Phplist | Tincan | 2.10.10 (including) | 2.10.10 (including) |
| Phplist | Tincan | 2.10.11 (including) | 2.10.11 (including) |
| Phplist | Tincan | 2.10.12 (including) | 2.10.12 (including) |
Potential Mitigations
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
- Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
- Use the “double-submitted cookie” method as described by Felten and Zeller:
- When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user’s machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
- Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
- This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/111.html
- https://cwe.mitre.org/data/definitions/462.html
- https://cwe.mitre.org/data/definitions/467.html
- https://cwe.mitre.org/data/definitions/62.html
References
- http://secunia.com/advisories/44041
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66666
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66816
- http://secunia.com/advisories/44041
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66666
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66816