CVE-2021-32157
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in Webmin 1.973 allows attackers to inject malicious scripts via the Scheduled Cron Jobs feature. When exploited, it enables session hijacking, credential theft, or complete system compromise through administrative actions. All users running vulnerable Webmin versions are affected.
💻 Affected Systems
- Webmin
📦 What is this software?
Webmin by Webmin
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover through administrative session hijacking, leading to data exfiltration, ransomware deployment, or persistent backdoor installation.
Likely Case
Session hijacking leading to unauthorized administrative access, privilege escalation, and lateral movement within the network.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting individual user sessions.
🎯 Exploit Status
Exploitation requires authenticated access to Webmin, but the XSS payload can be delivered through various vectors including phishing or compromised accounts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Webmin 1.974 and later
Vendor Advisory: https://www.webmin.com/security.html
Restart Required: No
Instructions:
1. Update Webmin to version 1.974 or later using the built-in update feature or package manager. 2. Verify the update completed successfully. 3. Clear browser caches and restart Webmin service if issues persist.
🔧 Temporary Workarounds
Disable Cron Jobs Module
linuxTemporarily disable the vulnerable Scheduled Cron Jobs module until patching is possible.
# Edit Webmin configuration to remove cron module
mv /usr/share/webmin/cron /usr/share/webmin/cron.disabled
systemctl restart webmin
Implement WAF Rules
allAdd Web Application Firewall rules to block XSS payloads targeting the cron jobs endpoint.
# Example ModSecurity rule for Apache
SecRule ARGS "<script" "id:1001,phase:2,deny,msg:'XSS Attack Detected'"
🧯 If You Can't Patch
- Restrict Webmin access to trusted IP addresses only using firewall rules.
- Implement Content Security Policy (CSP) headers to mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check Webmin version via web interface or command: cat /etc/webmin/versionCheck Version:
cat /etc/webmin/version || webmin --versionVerify Fix Applied:
Verify version is 1.974 or higher and test cron jobs interface with basic XSS payloads like <script>alert('test')</script>📡 Detection & Monitoring
Log Indicators:
- Unusual cron job creations/modifications in Webmin logs
- JavaScript payloads in URL parameters or POST data to cron endpoints
Network Indicators:
- HTTP requests containing script tags to /cron/ endpoints
- Unexpected outbound connections from Webmin server
SIEM Query:
source="webmin.log" AND ("cron" AND ("<script" OR "javascript:" OR "onerror="))