CVE-2020-35606
📋 TL;DR
This vulnerability allows authenticated users with Package Updates module access in Webmin to execute arbitrary commands with root privileges by injecting newline characters. It affects Webmin installations up to version 1.962 and exists due to incomplete fixes for CVE-2019-12840.
💻 Affected Systems
- Webmin
📦 What is this software?
Webmin by Webmin
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level command execution, leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Privilege escalation leading to unauthorized administrative access, configuration changes, or lateral movement within the network.
If Mitigated
Limited impact if proper access controls restrict Package Updates module to trusted administrators only.
🎯 Exploit Status
Exploit requires authenticated access; multiple public exploit scripts available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.962 and later (check for specific security updates)
Vendor Advisory: https://www.webmin.com/download.html
Restart Required: No
Instructions:
1. Update Webmin to latest version via package manager or manual download. 2. Verify update applied successfully. 3. Review user permissions for Package Updates module.
🔧 Temporary Workarounds
Restrict Package Updates Module Access
linuxRemove Package Updates module permissions from non-essential users
Edit Webmin user permissions via Webmin UI or configuration files
Input Validation Enhancement
linuxAdd input filtering for newline characters in Package Updates module
Modify /usr/share/webmin/package-updates/index.cgi to filter %0A and %0C
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Webmin instances
- Enable detailed logging and monitoring for command execution attempts
🔍 How to Verify
Check if Vulnerable:
Check Webmin version via web interface or command: cat /etc/webmin/versionCheck Version:
cat /etc/webmin/versionVerify Fix Applied:
Confirm version is above 1.962 and test Package Updates module functionality📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in Webmin logs
- Multiple failed authentication attempts followed by Package Updates access
Network Indicators:
- HTTP requests containing %0A or %0C characters to Webmin endpoints
SIEM Query:
source="webmin" AND ("%0A" OR "%0C") AND "package-updates"🔗 References
- http://packetstormsecurity.com/files/160676/Webmin-1.962-Remote-Command-Execution.html
- https://www.exploit-db.com/exploits/49318
- https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html
- https://www.webmin.com/download.html
- http://packetstormsecurity.com/files/160676/Webmin-1.962-Remote-Command-Execution.html
- https://www.exploit-db.com/exploits/49318
- https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html
- https://www.webmin.com/download.html
