News of the day is that Webmin contained a remote code execution vulnerability, tracked as CVE-2019-15107, for more than a year. The worst aspect of the story is that the flaw appears to be an intentional backdoor.
The flaw affects the procedure for changing expired passwords, the backdoor could be exploited by a remote attacker to execute malicious commands with root privileges on the machine running vulnerable Webmin.
The expert decided to not report the flaw to the Webmin development team.
The backdoor affects Webmin 1.882 through 1.921, but experts observed that default configuration are not vulnerable because the affected feature is not enabled by default. Only version 1.890 is affected also in the default configuration.
Webmin 1.930 and Usermin version 1.780 have addressed the flaw.
“I’ve rolled out Webmin version 1.930 and Usermin version 1.780 for all repositories. This release includes several security fixes, including one potentially serious one caused by malicious code inserted into Webmin and Usermin at some point on our build infrastructure.” Webmin developers explained.
“To exploit the malicious code, your Webmin installation must have Webmin -> Webmin Configuration -> Authentication -> Password expiry policy set to Prompt users with expired passwords to enter a new one. This option is not set by default, but if it is set, it allows remote code execution,”
Developers are still investigating how and when the
It seems that only
Searching with Shodan for internet-exposed Webmin installs, it is possible to find over 217,000 instances, most of them located in the United States, France and Germany. Only 1,400 are Webmin version 1.890, which is vulnerable in the default configuration.