CVE-2025-46011

Executive Summary

CVE-2025-46011 is a critical SQL Injection vulnerability discovered in Listmonk v4.1.0, a popular open-source newsletter and mailing list manager. The flaw resides in the QuerySubscribers function, allowing an unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation can lead to privilege escalation, data exfiltration, and full database compromise. The vulnerability is fixed in Listmonk v5.0.0. No public proof-of-concept (PoC) code or exploit is currently available, but the risk remains high due to the ease of exploitation and the sensitive nature of mailing list data.

Supply Chain & Package Security

Listmonk is a Go-based application. The vulnerability is in the application's own code, not in a third-party package. However, organizations using Listmonk should verify the integrity of their deployment and ensure no malicious modifications have been introduced. The Go module dependencies should be audited for known vulnerabilities, though this specific CVE is not related to a package supply chain issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service or data destruction.

Threat Level: Critical. Immediate patching is required.

Deep Dive & Mechanics

The QuerySubscribers function in Listmonk v4.1.0 is used to search or filter subscribers based on user-supplied input. The function fails to properly sanitize or parameterize SQL queries, allowing an attacker to inject malicious SQL code. The injection point is likely in a query parameter such as q, search, or a filter field.

Attack Flow:

1. An attacker sends a crafted HTTP request to the Listmonk API endpoint that calls QuerySubscribers.
2. The malicious input bypasses input validation and is concatenated directly into a SQL query.
3. The database executes the injected SQL, which can include UNION-based data extraction, time-based blind injection, or error-based techniques.
4. The attacker can then extract sensitive data (e.g., subscriber emails, passwords, API keys) or escalate privileges by modifying database records.

Example vulnerable code pattern (pseudocode):

func QuerySubscribers(search string) {
    query := "SELECT * FROM subscribers WHERE email LIKE '%" + search + "%'"
    db.Exec(query)
}

Patched code pattern:

func QuerySubscribers(search string) {
    query := "SELECT * FROM subscribers WHERE email LIKE ?"
    db.Exec(query, "%"+search+"%")
}

Vulnerable vs. Patched Code

Vulnerable (v4.1.0):

// Vulnerable: Direct string concatenation
func QuerySubscribers(search string) {
    query := fmt.Sprintf("SELECT * FROM subscribers WHERE email LIKE '%%%s%%'", search)
    rows, err := db.Query(query)
    // ...
}

Patched (v5.0.0):

// Patched: Parameterized query
func QuerySubscribers(search string) {
    query := "SELECT * FROM subscribers WHERE email LIKE ?"
    rows, err := db.Query(query, "%"+search+"%")
    // ...
}

The key difference is the use of parameterized queries (prepared statements) in the patched version, which prevents SQL injection by separating SQL logic from data.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Target: Listmonk v4.1.0 running on Ubuntu 22.04 with PostgreSQL.
• Attacker: Kali Linux with sqlmap and Burp Suite.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/subscribers?q=test).
2. Use sqlmap to automate injection:

   sqlmap -u "http://target:9000/api/subscribers?q=test" --batch --dbs
   

3. Manual injection example:

   ' UNION SELECT 1,2,3,email,password FROM users--
   

4. Extract admin credentials and escalate privileges.

Note: No public exploit code is available. The above is a generic SQL injection exploitation approach.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual SQL error messages in application logs (e.g., syntax error at or near).
2. Look for HTTP requests containing SQL keywords like UNION, SELECT, OR 1=1, --.
3. Use WAF rules to block common SQL injection patterns.

Response:

1. Immediately isolate the affected server.
2. Review database logs for unauthorized queries.
3. Rotate all secrets and credentials stored in the database.
4. Apply the patch by upgrading to v5.0.0.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/subscribers with suspicious parameters (e.g., q=1' OR '1'='1).
  • Outbound database connections from the Listmonk server to unusual IPs.
• File IOCs:
  • Modified application binaries or configuration files.
  • Unexpected files in the Listmonk data directory.
• Log IOCs:
  • Database error logs containing SQL syntax errors.
  • Application logs showing failed authentication attempts followed by successful admin login.

Detection Engineering

YARA Rule

rule CVE_2025_46011_Listmonk_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Listmonk QuerySubscribers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46011"
    strings:
        $s1 = "/api/subscribers" ascii wide nocase
        $s2 = "UNION" ascii wide nocase
        $s3 = "SELECT" ascii wide nocase
        $s4 = "OR 1=1" ascii wide nocase
        $s5 = "DROP" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against Listmonk QuerySubscribers
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in HTTP requests to Listmonk API
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-46011
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/api/subscribers"
        cs-uri-query|contains|all:
            - "q="
            - "'"
            - "OR"
            - "1=1"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in search terms (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46011 Listmonk SQL Injection Attempt"; flow:to_server,established; content:"/api/subscribers"; http_uri; content:"q="; http_uri; pcre:"/(\bUNION\b|\bSELECT\b|\bOR\b.*1=1|\bDROP\b)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Listmonk to version 5.0.0 or later.
2. Workaround: If immediate upgrade is not possible, restrict network access to the Listmonk API using a firewall or reverse proxy.
3. Long-term: Implement input validation and parameterized queries in all database interactions.
4. Monitoring: Enable detailed logging and set up alerts for SQL injection patterns.
5. Audit: Review all custom code for similar injection vulnerabilities.

Valters IT
Securing Digital Frontiers