CVE-2023-28733
📋 TL;DR
The AnyMailing Joomla Plugin has a stored cross-site scripting (XSS) vulnerability in templates and emails that allows attackers to inject malicious scripts. This affects front-office users with campaign creation access in Enterprise versions below 8.3.0, enabling script execution in victims' browsers.
💻 Affected Systems
- AnyMailing Joomla Plugin Enterprise
📦 What is this software?
Acymailing by Acymailing
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, deface websites, or redirect users to malicious sites through persistent script injection.
Likely Case
Attackers with front-office campaign creation access inject malicious scripts into templates/emails, compromising users who view them.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before execution.
🎯 Exploit Status
Exploitation requires front-office campaign creation privileges; stored XSS is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.0
Vendor Advisory: https://www.acymailing.com/change-log/
Restart Required: No
Instructions:
1. Log into Joomla admin panel. 2. Navigate to Extensions > Manage > Update. 3. Update AnyMailing plugin to version 8.3.0 or later. 4. Clear Joomla and browser caches.
🔧 Temporary Workarounds
Restrict Front-Office Campaign Creation
allLimit campaign creation permissions to trusted administrators only.
Implement Content Security Policy (CSP)
allAdd CSP headers to restrict script execution sources.
Header set Content-Security-Policy "default-src 'self'; script-src 'self'" in .htaccess or server config
🧯 If You Can't Patch
- Disable the AnyMailing plugin entirely if not essential.
- Implement strict input validation and output encoding in custom templates.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Joomla admin under Extensions > Manage > Manage.Check Version:
N/A for Joomla web interface; check via admin panel.Verify Fix Applied:
Confirm plugin version is 8.3.0 or higher in Extensions > Manage > Manage.📡 Detection & Monitoring
Log Indicators:
- Unusual template/email modifications by front-office users
- Script tags in campaign content logs
Network Indicators:
- Unexpected script loads from campaign pages
- Suspicious outbound connections from user browsers
SIEM Query:
search 'template_update' OR 'campaign_create' AND user_role='frontoffice'