"More than 9 million people and businesses around the world use MailChimp. Our features and integrations allow you to send marketing emails, automated messages, and targeted campaigns. And our detailed reports help you keep improving over time.
MailChimp has been around since 2001. We started as a side project funded by various web-development jobs. Now we send more than 600 million emails a day. We love seeing businesses start small, fund themselves with paying projects, and build up a strong API, so that's how we run MailChimp. We create products and features that empower our customers to grow."
MailChimp has been around since 2001. We started as a side project funded by various web-development jobs. Now we send more than 600 million emails a day. We love seeing businesses start small, fund themselves with paying projects, and build up a strong API, so that's how we run MailChimp. We create products and features that empower our customers to grow."
The vulnerability exists at “http://login.mailchimp.com/?” page with “referrer” parameter, e.g.
http://login.mailchimp.com/?referrer=http://google.com [1]
http://login.mailchimp.com/?referrer=http://google.com [1]
When a user clicks the URL ([1]) before login, the MailChimp “login page” appears. The user needs to enter his/her username and password. When this is done, the user could be redirected to a webpage different from MailChimp.
Tests were performed on Microsoft IE (9 9.0.8112.16421) of Windows 8, Mozilla Firefox (37.0.2) & Google Chromium 42.0.2311 (64-bit) of Ubuntu (14.04.2)，and Apple Safari 6.1.6 of Mac OS X v10.9 Mavericks.
(1) Use the following tests to illustrate the scenario painted above.
The redirected webpage address is “http://www.tetraph.com/essayjeans/”. We can suppose that this webpage is malicious.
Reporter:
Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)
http://www.tetraph.com/wangjing/
http://www.tetraph.com/wangjing/
