CVE-2025-58430

Executive Summary

CVE-2025-58430 is a security advisory affecting listmonk, a self-hosted newsletter and mailing list manager, up to and including version 1.1.0. The vulnerability lies in the improper validation of the nonce parameter included in every HTTP request alongside the session cookie. The backend does not check or validate the nonce value, and removing it still allows requests to be processed correctly. While seemingly harmless in isolation, this flaw can be chained with other vulnerabilities (such as Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)) to achieve critical impact, including improper admin account creation. No patched versions are available at this time.

Supply Chain & Package Security

listmonk is a standalone Go application distributed as a single binary or via Docker. There is no NPM, PyPI, Go module, or Ruby gem dependency chain directly affected. However, users should verify the integrity of their downloaded binaries and Docker images from the official GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base) but chained impact is critical.
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Threat Level: Critical when chained with XSS/CSRF.

Deep Dive & Mechanics

The vulnerability stems from the application's session management. Every HTTP request includes a session cookie and a nonce parameter. The nonce is intended to prevent CSRF attacks, but the backend does not validate its value. An attacker can craft a request without a nonce or with an arbitrary nonce, and the server will still process it.

Chained Attack Scenario:

1. XSS: An attacker exploits a stored XSS vulnerability (if present) or uses social engineering to inject malicious JavaScript into an admin's browser.
2. CSRF: The injected script makes a request to create a new admin account, omitting the nonce parameter. Since the backend does not validate the nonce, the request is processed.
3. Result: The attacker gains admin access, leading to full compromise of the mailing list manager.

The root cause is the lack of server-side validation of the nonce token, making the CSRF protection ineffective.

Vulnerable vs. Patched Code

Vulnerable Code (listmonk <= 1.1.0):

// Session middleware does not validate nonce
func sessionMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        // Nonce is read but not validated
        nonce := r.URL.Query().Get("nonce")
        // ... session handling ...
        next.ServeHTTP(w, r)
    })
}

Patched Code (Hypothetical):

func sessionMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        nonce := r.URL.Query().Get("nonce")
        // Validate nonce against session store
        if nonce == "" || !validateNonce(nonce, r) {
            http.Error(w, "Invalid nonce", http.StatusForbidden)
            return
        }
        next.ServeHTTP(w, r)
    })
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy listmonk 1.1.0 in a Docker container.
2. Craft Payload: Create an HTML page that auto-submits a form to create a new admin user, omitting the nonce parameter.

   <form action="http://target:9000/admin/users" method="POST">
       <input type="hidden" name="username" value="attacker">
       <input type="hidden" name="password" value="pwned123">
       <input type="submit" value="Submit">
   </form>
   <script>document.forms[0].submit();</script>
   

3. Deliver: Send the link to an authenticated admin (e.g., via email or XSS).
4. Result: A new admin account is created without CSRF protection.

Blue Team

1. Monitor: Look for requests to /admin/users or other sensitive endpoints without a nonce parameter.
2. Detect: Use the Sigma rule below to detect missing nonce in logs.
3. Mitigate: Implement a WAF rule to block requests to sensitive endpoints without a valid nonce.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /admin/users or /admin/settings without a nonce parameter.
• Logs: Server logs showing POST requests to admin endpoints with missing or empty nonce field.
• Accounts: Unexpected admin accounts with usernames like attacker, admin2, etc.
• File: Unusual entries in the users table of the listmonk database.

Detection Engineering

YARA Rule

rule listmonk_nonce_bypass {
    meta:
        description = "Detects requests to listmonk admin endpoints without nonce parameter"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-58430"
    strings:
        $admin_path = "/admin/"
        $nonce_param = "nonce="
    condition:
        $admin_path and not $nonce_param
}

Sigma Rule

title: Listmonk CSRF Nonce Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to listmonk admin endpoints without the nonce parameter
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: listmonk
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/'
    filter:
        cs-uri-query|contains: 'nonce='
    condition: selection and not filter
falsepositives:
    - Legitimate requests with nonce
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58430 - Listmonk CSRF Nonce Bypass"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/"; nocase; pcre:"/nonce=/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Implement a reverse proxy (e.g., Nginx) to block requests to /admin/ endpoints that lack a nonce parameter.

   location /admin/ {
       if ($arg_nonce = "") {
           return 403;
       }
   }
   

2. Short-term: Manually patch the source code to validate the nonce on the server side (see patched code above).
3. Long-term: Monitor the official listmonk repository for a patched version and upgrade immediately.
4. Compensating Controls: Enable multi-factor authentication (MFA) for admin accounts and restrict admin access to trusted IPs.

Valters IT
Securing Digital Frontiers