Webmin password_change.cgi Command Injection

An issue was discovered in Webmin through 1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Recent assessments:

wvu-r7 at August 21, 2019 3:12am UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

busterb at August 20, 2019 6:37pm UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

ZM-20-20 at January 30, 2021 1:40am UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

bwatters-r7 at August 22, 2019 10:22pm UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

jrobles-r7 at August 20, 2019 6:02pm UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

sgonzalez-r7 at August 26, 2019 4:31pm UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

P1d0f at July 10, 2020 4:11am UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

69 at February 28, 2020 4:26pm UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

KoelhoSec at April 09, 2021 2:48am UTC reported:

This was a supply chain attack: <http://www.webmin.com/exploit.html&gt;. The backdoor was introduced in a version that was “exploitable” in the default install. Version 1.890 is the money. Anything after requires a non-default setting.

Note that SourceForge installs are affected, but GitHub checkouts aren’t.

ETA: Metasploit added an exploit module.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5