Description

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.1 is able to resolve this issue. This patch is called d95868dff3da4d3bd4f942837a26cb7c73a797ae. It is suggested to upgrade the affected component. The vendor fixed the issue the same day it was reported, in version 3.1, by gating the endpoint on an authenticated session or the new Blacklist_ALLOWLIST option.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-15T06:17:00.643Z",
  "pubdate": "2026-09-15T06:17:00.643Z",
  "executiveSummary": "A critical vulnerability identified in stamparm maltrail versions up to 3.0.1 allows for an authentication bypass within the Blacklist Endpoint.\nThe vulnerability resides in the _blacklist function of core/httpd.py, enabling unauthorized access to sensitive security-related functionality.\nThe flaw allows remote, unauthenticated attackers to interact with the blacklist component, which could be leveraged to manipulate threat intelligence data or influence security monitoring capabilities.\nGiven that exploit code is publicly available, the risk of exploitation is high.\nAffected systems remain exposed to unauthorized remote manipulation until the software is updated to version 3.1 or higher.\nOrganizations using maltrail should prioritize patching to version 3.1, which introduces mandatory session-based authentication or the Blacklist_ALLOWLIST configuration to secure the endpoint.",
  "technicalDetails": "The vulnerability is located in the _blacklist function within the core/httpd.py file of the stamparm maltrail application. This component is responsible for managing the blacklist endpoint, which interfaces with the tool's threat detection and mitigation mechanisms.\nThe root cause is a failure to implement proper access control checks or session validation within the _blacklist function. In affected versions (up to 3.0.1), the endpoint processes requests without verifying the identity or authorization level of the requester, effectively bypassing intended authentication barriers.\nThe attack vector is remote, allowing an unauthorized actor to send crafted HTTP requests directly to the Blacklist Endpoint. By interacting with this function without a valid session, an attacker can manipulate or query the blacklist data structure used by the system.\nThe exploitation flow begins when an attacker identifies the publicly accessible /blacklist or related endpoint on a target maltrail instance. Because the application logic in core/httpd.py fails to guard the _blacklist function with an authentication handshake or verify an active administrative session, the server processes the request as if it were legitimate.\nAn attacker can exploit this to illicitly modify blacklisted entries, potentially whitelisting malicious IP addresses or infrastructure to evade detection, or retrieving sensitive blacklist information. The absence of gated access means no credentials or prior authorization are required to execute these operations.\nThis vulnerability is particularly severe because the public availability of exploit code lowers the barrier to entry for attackers to perform unauthorized administrative actions remotely. The post-exploitation impact includes the degradation of security posture, as the system's ability to identify and block known threats is directly compromised by the unauthorized manipulation of its core filtering lists.\nIn version 3.1, the vendor implemented a remediation strategy that integrates an authentication check before the _blacklist function is executed. Furthermore, the introduction of the Blacklist_ALLOWLIST option provides a granular control mechanism to verify requester legitimacy, ensuring that the endpoint is no longer exposed to unauthenticated remote interactions."
}