Very High
Webmin password_change.cgi Command Injection
Very High
(9 users assessed)
Very High
(9 users assessed)Unknown
Unknown
Unknown
Webmin password_change.cgi Command Injection
Description
An issue was discovered in Webmin through 1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
Add Assessment
Technical Analysis
This was a supply chain attack: http://www.webmin.com/exploit.html. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.
Note that SourceForge installs are affected, but GitHub checkouts aren’t.
ETA: Metasploit added an exploit module.
Technical Analysis
This is bound to have many vulnerable installations that may persist for some time, since webmin tends to be used by novice admins.
What type of attack was this? how this was added to the code for Webmin, not how this results in remote code execution (RCE).
There is more information here on how the attack was carried out: http://www.webmin.com/exploit.html
From the article:
At some time in April 2018, the Webmin development build server was exploited and a vulnerability added to the password_change.cgi script. Because the timestamp on the file was set back, it did not show up in any Git diffs. This was included in the Webmin 1.890 release.
Technical Analysis
This is a terrible situation for any development team. A hacker took over a server that managed webmin code and changed the code in a subtle way to allow them (or others) to execute commands as root on computers running Webmin. It took nearly a year and a half for the attack to be discovered and fixed.
Technical Analysis
I tested Webmin v1.900 and the password change page was not available by default, however it is a reasonable option to have.
A valid username is not needed for the exploit, although the command injection did not work for me when I used the valid username root.
Technical Analysis
This vulnerability is very easy to exploit – without the need for any tools specialized for this attack.
Technical Analysis
MetaSploit module available:
exploit/linux/http/webmin_backdoor
Description:
This module exploits a backdoor in Webmin versions 1.890 through
1.920. Only the SourceForge downloads were backdoored, but they are
listed as official downloads on the project’s site. Unknown
attacker(s) inserted Perl qx statements into the build server’s
source code on two separate occasions: once in April 2018,
introducing the backdoor in the 1.890 release, and in July 2018,
reintroducing the backdoor in releases 1.900 through 1.920. Only
version 1.890 is exploitable in the default install. Later affected
versions require the expired password changing feature to be
enabled.
General Information
Metasploit Modules
Exploited in the Wild
References
