phpList CSRF on subscription page

For those who don't know phpList...

... is an open source software for managing mailing lists. It is designed for the dissemination of information, such as newsletters, news, advertising to list of subscribers. It is written in PHP and uses a MySQL database to store the information. The software is distributed free under GPL license. (in Wikipedia)

I discover a CSRF vulnerability on phpList 3.0.5 (and maybe prior versions) - CVE-2014-2916 -  that allowed a malicious user to perform a variety of attacks (deface, malware spreading, phishing, etc.).
If a specially crafted page is visited by any authenticated administrator it's possible to launch a CSRF that will be automatically executed without the admin knowing it about.

The problem is that the subscription page editor - /phplist/admin/?page=spageedit - doesn't have protection against this type of vulnerability.
So, if a authenticated administrator visits a specific page that sends a form automatically it will store the malicious code on the subscription page.

Fix it ASAP!
phpList team have already patched this issue on phpList 3.0.6, so I recommend the download as soon as possible.

I would like to thank Michiel Dethmers from phpList for getting me updated on the fixing status and showing that phpList team really care about security.

Timeline
02 Apr 2014: Reported this advisory to phpList
03 Apr 2014: phpList replied that they redirected the lead developer
04 Apr 2014: Lead developer replied that they are working on fixing it
15 Apr 2014: phpList 3.0.6 is released
21 Apr 2014: Credit for this vulnerability was published on phpList news section
22 Apr 2014: Full disclosure

Wordpress, FBI and TOR, Kernel.org and DOM XSS

Here what's worth reading during this week:

- Statistics Show Why WordPress is a Popular Hacker Target http://www.wpwhitesecurity.com/wordpress-news/statistics-70-percent-wordpress-installations-vulnerable/
- Analysis of the FBI Tor Malware http://oweng.myweb.port.ac.uk/fbi-tor-malware-analysis/
- Who rooted kernel.org servers two years ago, how did it happen, and why? http://arstechnica.com/security/2013/09/who-rooted-kernel-org-servers-two-years-ago-how-did-it-happen-and-why/
- 25 Million Flows Later - Large-scale Detection of DOM-based XSS http://ben-stock.de/wp-content/uploads/domxss.pdf
- Summary of our CCS paper on DOM-based XSS http://ben-stock.de/2013/09/summary-of-our-ccs-paper-on-dom-based-xss/

Feel free to suggest some new articles. Just tweet @dsopas.

DOM XSS vulnerabilities on Booking.com

Booking.com B.V., part of Priceline.com (Nasdaq: PCLN), owns and operates Booking.com, the world leader in booking accommodation online. Each day, over 400,000 room nights are reserved on Booking.com, and the website attracts over 30 million unique visitors each month from both the leisure and business sectors worldwide.

On January I started receiving some phishing emails using Booking.com as bait to spread malware.
If these malicious users had the right tools - like for example a XSS vulnerability - they could infect more users. That would not be good...

After browsing a little bit the website I found out two DOM XSS vulnerabilities.
Both vulnerabilities we're explored due to the lack of escaping the location.hash and using an older version of jQuery. That way it was possible for user to inject code into a victims browser DOM.

Proof of concept #1 (iPhone landing)

http://www.booking.com/general.en-us.html?sid=c81e148e3eceef6c8e2073bc50258a1c;dcid=1;tmpl=docs/iphone_landing&=&#<img src=x onerror=prompt("xss");>

Proof of concept #2 (FAQ section)

http://www.booking.com/general.en-us.html?dcid=1&sid=c81e148e3eceef6c8e2073bc50258a1c&tmpl=docs/faqmain#<img src=x onerror=prompt("xss");>

Both issues are now fixed.

I only was able to receive any reply from Booking.com team when contacting them via Twitter. After that I established a conversation with their security team who were very effective and fast, solving both vulnerabilities on a couple of hours. They reported that they're working on making the site safer everyday and appreciate any assistance.
Thanks for that.