|
 |
8cf1bd |
diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
|
|
|
8cf1bd |
index 73b003a..4328066 100644
|
|
|
8cf1bd |
--- a/Mailman/CSRFcheck.py
|
|
|
8cf1bd |
+++ b/Mailman/CSRFcheck.py
|
|
|
8cf1bd |
@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
|
|
|
8cf1bd |
token = binascii.hexlify(marshal.dumps((issued, keymac)))
|
|
|
8cf1bd |
return token
|
|
|
8cf1bd |
|
|
|
8cf1bd |
-def csrf_check(mlist, token, options_user=None):
|
|
|
8cf1bd |
+def csrf_check(mlist, token, cgi_user=None):
|
|
|
8cf1bd |
""" check token by mailman cookie validation algorithm """
|
|
|
8cf1bd |
try:
|
|
|
8cf1bd |
issued, keymac = marshal.loads(binascii.unhexlify(token))
|
|
|
8cf1bd |
@@ -66,12 +66,25 @@ def csrf_check(mlist, token, options_user=None):
|
|
|
8cf1bd |
key, user = key.split('+', 1)
|
|
|
8cf1bd |
else:
|
|
|
8cf1bd |
user = None
|
|
|
8cf1bd |
+ # Don't allow unprivileged tokens for admin or admindb.
|
|
|
8cf1bd |
+ if cgi_user == 'admin':
|
|
|
8cf1bd |
+ if key not in ('admin', 'site'):
|
|
|
8cf1bd |
+ syslog('mischief',
|
|
|
8cf1bd |
+ 'admin form submitted with CSRF token issued for %s.',
|
|
|
8cf1bd |
+ key + '+' + user if user else key)
|
|
|
8cf1bd |
+ return False
|
|
|
8cf1bd |
+ elif cgi_user == 'admindb':
|
|
|
8cf1bd |
+ if key not in ('moderator', 'admin', 'site'):
|
|
|
8cf1bd |
+ syslog('mischief',
|
|
|
8cf1bd |
+ 'admindb form submitted with CSRF token issued for %s.',
|
|
|
8cf1bd |
+ key + '+' + user if user else key)
|
|
|
8cf1bd |
+ return False
|
|
|
8cf1bd |
if user:
|
|
|
8cf1bd |
# This is for CVE-2021-42097. The token is a user token because
|
|
|
8cf1bd |
# of the fix for CVE-2021-42096 but it must match the user for
|
|
|
8cf1bd |
# whom the options page is requested.
|
|
|
8cf1bd |
raw_user = UnobscureEmail(urllib.unquote(user))
|
|
|
8cf1bd |
- if options_user and options_user != raw_user:
|
|
|
8cf1bd |
+ if cgi_user and cgi_user != raw_user:
|
|
|
8cf1bd |
syslog('mischief',
|
|
|
8cf1bd |
'Form for user %s submitted with CSRF token '
|
|
|
8cf1bd |
'issued for %s.',
|
|
|
8cf1bd |
diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
|
|
|
8cf1bd |
index 6a391df..7df4726 100644
|
|
|
8cf1bd |
--- a/Mailman/Cgi/admin.py
|
|
|
8cf1bd |
+++ b/Mailman/Cgi/admin.py
|
|
|
8cf1bd |
@@ -91,7 +91,8 @@ def main():
|
|
|
8cf1bd |
'letter', 'chunk', 'findmember']
|
|
|
8cf1bd |
params = cgidata.keys()
|
|
|
8cf1bd |
if set(params) - set(safe_params):
|
|
|
8cf1bd |
- csrf_checked = csrf_check(mlist, cgidata.getvalue('csrf_token'))
|
|
|
8cf1bd |
+ csrf_checked = csrf_check(mlist, cgidata.getvalue('csrf_token'),
|
|
|
8cf1bd |
+ 'admin')
|
|
|
8cf1bd |
else:
|
|
|
8cf1bd |
csrf_checked = True
|
|
|
8cf1bd |
# if password is present, void cookie to force password authentication.
|
|
|
8cf1bd |
diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
|
|
|
8cf1bd |
index defc58d..ea8bf78 100644
|
|
|
8cf1bd |
--- a/Mailman/Cgi/admindb.py
|
|
|
8cf1bd |
+++ b/Mailman/Cgi/admindb.py
|
|
|
8cf1bd |
@@ -108,7 +108,8 @@ def main():
|
|
|
8cf1bd |
safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
|
|
|
8cf1bd |
params = cgidata.keys()
|
|
|
8cf1bd |
if set(params) - set(safe_params):
|
|
|
8cf1bd |
- csrf_checked = csrf_check(mlist, cgidata.getvalue('csrf_token'))
|
|
|
8cf1bd |
+ csrf_checked = csrf_check(mlist, cgidata.getvalue('csrf_token'),
|
|
|
8cf1bd |
+ 'admindb')
|
|
|
8cf1bd |
else:
|
|
|
8cf1bd |
csrf_checked = True
|
|
|
8cf1bd |
# if password is present, void cookie to force password authentication.
|
|
|
8cf1bd |
diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
|
|
|
8cf1bd |
index 5c9416e..678e43c 100644
|
|
|
8cf1bd |
--- a/Mailman/Cgi/edithtml.py
|
|
|
8cf1bd |
+++ b/Mailman/Cgi/edithtml.py
|
|
|
8cf1bd |
@@ -89,7 +89,8 @@ def main():
|
|
|
8cf1bd |
safe_params = ['VARHELP', 'adminpw', 'admlogin']
|
|
|
8cf1bd |
params = cgidata.keys()
|
|
|
8cf1bd |
if set(params) - set(safe_params):
|
|
|
8cf1bd |
- csrf_checked = csrf_check(mlist, cgidata.getvalue('csrf_token'))
|
|
|
8cf1bd |
+ csrf_checked = csrf_check(mlist, cgidata.getvalue('csrf_token'),
|
|
|
8cf1bd |
+ 'admin')
|
|
|
8cf1bd |
else:
|
|
|
8cf1bd |
csrf_checked = True
|
|
|
8cf1bd |
# if password is present, void cookie to force password authentication.
|