• Vulnerability Type: Command Injection
• Vendor: GNU Mailman (GNU Mailman)
• Affected Versions: Mailman 2.1.39; likely affects older 2.1.x versions (pending regression testing)
• Affected Components:
  • External archiver configuration (PUBLIC_EXTERNAL_ARCHIVER, PRIVATE_EXTERNAL_ARCHIVER)
  • Mailman/Handlers/ (email subject processing logic, potentially including files like CookHeaders.py)
• Root Cause: When an external archiver is configured, the email subject line may be passed to a shell command without proper sanitization, allowing execution of arbitrary commands if shell metacharacters (e.g., ;, &, |) are present.
• Status: No official fix available. Mailman 2.1.x is end-of-life (EOL); migration to Mailman 3.x is strongly recommended.

Proof of Concept

To exploit this vulnerability, an attacker can send an email to a Mailman-managed list with a malicious subject line, such as:

Prerequisites:

• The target Mailman list must have an external archiver configured via PUBLIC_EXTERNAL_ARCHIVER or PRIVATE_EXTERNAL_ARCHIVER.
• The attacker must control a mail server or client capable of sending to the target list.
• A listener (e.g., netcat) must be set up on ATTACKERIP:4444 to receive the reverse shell.

Expected Outcome: If the external archiver command does not sanitize the subject line, the malicious command executes on the server, establishing a reverse shell to the attacker’s server.

Attack Vectors

• Primary Vector: Malicious email subject lines containing shell metacharacters sent to a Mailman-managed mailing list with an external archiver configured.
• Exploitation Scenarios:
  • Establish reverse shells for persistent access.
  • Execute commands to exfiltrate data, modify configurations, or install malware.
  • Chain with other vulnerabilities to escalate attacks.
• Ease of Exploitation: High, as any email sender can target public or misconfigured lists with an external archiver setup.

Security Impact

• Code Execution: High (arbitrary OS command execution).
• Privilege Escalation: High (potential root access depending on Mailman’s runtime privileges).
• Information Disclosure: High (command output can reveal system data).
• Denial of Service: High (malicious commands can crash or overload the server).

Mitigations

Immediate Actions

• Disable External Archivers: Set PUBLIC_EXTERNAL_ARCHIVER and PRIVATE_EXTERNAL_ARCHIVER to None in mm_cfg.py to disable external archiver functionality:

  root@kitploit:~

  PUBLIC_EXTERNAL_ARCHIVER = None
  PRIVATE_EXTERNAL_ARCHIVER = None
  

• Sanitize Inputs: If an external archiver is required, ensure the command sanitizes the subject line to prevent shell metacharacter injection.

• Restrict Subscriptions: Limit mailing list subscriptions to trusted users to reduce exposure.

Long-Term Solutions

• Upgrade to Mailman 3.x: Migrate to Mailman 3.x, which implements robust input sanitization and is actively maintained.
• Disable Email Processing: If not required, disable Mailman’s email processing functionality to eliminate the attack vector.
• Harden Environment: Run Mailman in a containerized environment with minimal privileges to limit the impact of potential exploits.

Timeline

• Q1 2025: Discovered during authorized penetration testing assessment.
• Q1 2025: Reported to GNU Mailman and cPanel maintainers.
• April 2025: CVE assigned by MITRE.
• April 2025: Public disclosure via this repository.

References

• Mailman 2.1 Source Code
• CVE-2025-43920 Record
• Mailman Security Recommendations
• INCIBE-CERT - CVE-2025-43920
• VULDB - CVE-2025-43920
• National Institute of Standards and Technology (NIST) - CVE-2025-43920
• Tenable - CVE-2025-43920

Acknowledgments

Firudin Davudzada and Musazada Aydan responsibly disclosed this vulnerability during a sanctioned penetration testing engagement. Thanks to the MITRE CVE team for coordination.

Contact

Email: [email protected]\