Very High
Webmin password_change.cgi Command Injection
Very High
Webmin password_change.cgi Command Injection
Exploitability
Description
An issue was discovered in Webmin through 1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
Add Assessment
Technical Analysis
This was a supply chain attack: http://www.webmin.com/exploit.html. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.
Note that SourceForge installs are affected, but GitHub checkouts aren’t.
ETA: Metasploit added an exploit module.
Technical Analysis
This is bound to have many vulnerable installations that may persist for some time, since webmin tends to be used by novice admins.
What type of attack was this? how this was added to the code for Webmin, not how this results in remote code execution (RCE).
There is more information here on how the attack was carried out: http://www.webmin.com/exploit.html
From the article:
At some time in April 2018, the Webmin development build server was exploited and a vulnerability added to the password_change.cgi script. Because the timestamp on the file was set back, it did not show up in any Git diffs. This was included in the Webmin 1.890 release.
Technical Analysis
This is a terrible situation for any development team. A hacker took over a server that managed webmin code and changed the code in a subtle way to allow them (or others) to execute commands as root on computers running Webmin. It took nearly a year and a half for the attack to be discovered and fixed.
Technical Analysis
I tested Webmin v1.900 and the password change page was not available by default, however it is a reasonable option to have.
A valid username is not needed for the exploit, although the command injection did not work for me when I used the valid username root.
Technical Analysis
This vulnerability is very easy to exploit – without the need for any tools specialized for this attack.
General Information
References
