listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover
Date: 2025-09
Affected: go/github.com/knadh/listmonk
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-58430
CWE: CWE-352
CWE-79
CWE-80

### Summary Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. ### Details During a security evaluation of the webapp, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Example HTTP request without nonce : <img width="1418" height="772" alt="user_creation_without_nonce_burp_request" src="https://github.com/user-attachments/assets/a5026cdd-d360-4919-ae66-29856c3d3f32" /> ### PoC Let's look at a “chain” case of vulnerabilities that include the CSRF and XSS. An admin (or any user with permissions) can create templates and preview them (`POST /api/templates/preview` ) making it possible to execute javascript code. For example: <img width="1912" height


Mitigations:

Architectural layers (MAESTRO):