From a306294cf9e4d4a4ded2c840f9a1ce8ba412b6a7 Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Tue, 30 Nov 2021 09:50:49 -0800
Subject: Block CSRF attack against admin or admindb pages.

---
 Mailman/CSRFcheck.py    | 17 +++++++++++++++--
 Mailman/Cgi/admin.py    |  3 ++-
 Mailman/Cgi/admindb.py  |  3 ++-
 Mailman/Cgi/edithtml.py |  3 ++-
 4 files changed, 21 insertions(+), 5 deletions(-)

(limited to 'Mailman')

diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
index 4505f9d4..9a0b67fc 100644
--- a/Mailman/CSRFcheck.py
+++ b/Mailman/CSRFcheck.py
@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
     token = binascii.hexlify(marshal.dumps((issued, keymac)))
     return token
 
-def csrf_check(mlist, token, options_user=None):
+def csrf_check(mlist, token, cgi_user=None):
     """ check token by mailman cookie validation algorithm """
     try:
         issued, keymac = marshal.loads(binascii.unhexlify(token))
@@ -67,12 +67,25 @@ def csrf_check(mlist, token, options_user=None):
             key, user = key.split('+', 1)
         else:
             user = None
+        # Don't allow unprivileged tokens for admin or admindb.
+        if cgi_user == 'admin':
+            if key not in ('admin', 'site'):
+                syslog('mischief',
+                       'admin form submitted with CSRF token issued for %s.',
+                       key + '+' + user if user else key)
+                return False
+        elif cgi_user == 'admindb':
+            if key not in ('moderator', 'admin', 'site'):
+                syslog('mischief',
+                       'admindb form submitted with CSRF token issued for %s.',
+                       key + '+' + user if user else key)
+                return False
         if user:
             # This is for CVE-2021-42097.  The token is a user token because
             # of the fix for CVE-2021-42096 but it must match the user for
             # whom the options page is requested.
             raw_user = UnobscureEmail(urllib.unquote(user))
-            if options_user and options_user != raw_user:
+            if cgi_user and cgi_user != raw_user:
                 syslog('mischief',
                        'Form for user %s submitted with CSRF token '
                        'issued for %s.',
diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
index b5f14824..a25d7e74 100644
--- a/Mailman/Cgi/admin.py
+++ b/Mailman/Cgi/admin.py
@@ -107,7 +107,8 @@ def main():
                    'legend']
     params = cgidata.keys()
     if set(params) - set(safe_params):
-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
+        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
+                                  'admin')
     else:
         csrf_checked = True
     # if password is present, void cookie to force password authentication.
diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
index 45ba6492..a210efd9 100644
--- a/Mailman/Cgi/admindb.py
+++ b/Mailman/Cgi/admindb.py
@@ -144,7 +144,8 @@ def main():
     safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
     params = cgidata.keys()
     if set(params) - set(safe_params):
-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
+        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
+                                  'admindb')
     else:
         csrf_checked = True
     # if password is present, void cookie to force password authentication.
diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
index 1dd9e87b..170e8116 100644
--- a/Mailman/Cgi/edithtml.py
+++ b/Mailman/Cgi/edithtml.py
@@ -111,7 +111,8 @@ def main():
     safe_params = ['VARHELP', 'adminpw', 'admlogin']
     params = cgidata.keys()
     if set(params) - set(safe_params):
-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
+        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
+                                  'admin')
     else:
         csrf_checked = True
     # if password is present, void cookie to force password authentication.
-- 
cgit v1.2.3