9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jc7g-x28f-3v3h

GHSA-jc7g-x28f-3v3h: listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Summary

The env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the {{ env }} template expression to capture sensitive environment variables.

Upgrade to v5.0.2 to mitigate.

Demonstration

Description

A critical template injection vulnerability exists in Listmonk's campaign preview functionality that allows authenticated users with minimal privileges (campaigns:get & campaigns:get_all) to extract sensitive system data, including database credentials, SMTP passwords, and admin credentials due to some dangerous function being allowed.

Proof of Concept

Create a user and give him campaigns:get and campaigns:get_all privileges

Now login with that user, go to any campaign, go the Content section and here lies the vulnerability, we're able to execute template content which allows us to get environment variables, execute Sprig functions...
Now in the text field you can input the following and press Preview:

{{ env "AWS_KEY" }}
{{ env "LISTMONK_db__user" }}
{{ env "LISTMONK_db__password" }}

Preview:

I had the AWS_KEY variable set like that to confirm the vulnerability:

Impact

Through these environment variables the attacker can access, they can fully compromise the database, cloud accounts, admin credentials, and more depending on what was setup leading to total system takeover and data breach.

Suggested Fix

Blacklist some function for templates like env, expandEnv and fail as they can be used to leak environment variables which leads to a full takeover.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jc7g-x28f-3v3h

GHSA-jc7g-x28f-3v3h:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/knadh/listmonk	go	>= 4.0.0, < 5.0.2	5.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (GHSA-jc7g-x28f-3v3h) in Listmonk allows low-privilege users to read sensitive system environment variables via template injection. This is due to the inclusion of dangerous functions (env and expandenv) from the Sprig template library, which are enabled by default.

The analysis of the provided patch (commit d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e) reveals that two specific functions in Listmonk were responsible for making these Sprig functions available:

main.initTplFuncs (in cmd/init.go): This function initializes global template functions for the application.
manager.makeGnericFuncMap (in internal/manager/manager.go): This function prepares a map of template functions used within the manager's context.

Prior to the patch, both functions directly used sprig.GenericFuncMap() to populate the list of available template functions, thereby including env and expandenv. The fix applied in the patch modifies these two functions to explicitly delete env and expandenv from the map of Sprig functions before they are made available to the templating engine.

Therefore, these two functions, in their pre-patch state, are identified as the points in the Listmonk codebase that introduced the vulnerability by failing to restrict access to these powerful Sprig functions. An attacker with permissions to edit templates (e.g., in campaign content, as shown in the PoC) could then craft a template to call {{ env "VARIABLE_NAME" }} or {{ expandenv "$VARIABLE_NAME" }}, leading to the disclosure of potentially critical information like database credentials, API keys, or other secrets stored in environment variables. During exploitation, if a profiler were attached, calls originating from template processing would eventually trace back to the execution of these Sprig functions, which were made available by main.initTplFuncs or manager.makeGnericFuncMap (depending on the execution path). The functions themselves (initTplFuncs, makeGnericFuncMap) would appear in the call stack during the setup phase where template functions are registered, rather than during the direct exploitation of the env function call within a template. However, they are the direct enablers of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.1

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-jc7g-x28f-3v3h: listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Summary

Demonstration

Description

Proof of Concept

Preview:

Impact

Suggested Fix

GHSA-jc7g-x28f-3v3h:

9.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

9.1

9.1

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

GHSA-jc7g-x28f-3v3h: listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Summary

Demonstration

Description

Proof of Concept

Preview:

Impact

Suggested Fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI