CVE-2021-32162
📋 TL;DR
This CSRF vulnerability in Webmin's File Manager allows attackers to trick authenticated administrators into performing unauthorized file operations. It affects Webmin versions 1.973 and potentially earlier versions. Attackers can exploit this when administrators are logged into Webmin and visit malicious websites.
💻 Affected Systems
- Webmin
📦 What is this software?
Webmin by Webmin
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file upload, deletion, or modification leading to remote code execution, privilege escalation, or data destruction.
Likely Case
Unauthorized file operations including upload, download, deletion, or modification of sensitive system files and user data.
If Mitigated
Limited impact with proper CSRF protections, network segmentation, and administrative awareness.
🎯 Exploit Status
Exploitation requires the victim administrator to be authenticated and visit a malicious website. Public proof-of-concept code is available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.974 and later
Vendor Advisory: https://www.webmin.com/security.html
Restart Required: No
Instructions:
1. Update Webmin to version 1.974 or later using the built-in update feature or package manager. 2. Verify the update completed successfully. 3. Clear browser cache and cookies.
🔧 Temporary Workarounds
Disable File Manager
allTemporarily disable the File Manager module if not required
# In Webmin: Webmin Configuration -> Module Configuration -> Uncheck 'File Manager'
Implement CSRF Tokens
linuxAdd custom CSRF protection to Webmin configuration
# Add to /etc/webmin/config: csrf_token=1
# Restart Webmin: systemctl restart webmin
🧯 If You Can't Patch
- Implement network segmentation to restrict Webmin access to trusted IP addresses only
- Use separate browser profiles for administrative tasks and general browsing, and log out of Webmin when not in use
🔍 How to Verify
Check if Vulnerable:
Check Webmin version via web interface (Webmin -> Webmin Configuration -> Version) or command line: grep version= /etc/webmin/miniserv.confCheck Version:
grep version= /etc/webmin/miniserv.conf | cut -d= -f2Verify Fix Applied:
Verify version is 1.974 or higher and test File Manager functionality with CSRF testing tools📡 Detection & Monitoring
Log Indicators:
- Unusual file operations in Webmin logs
- Multiple failed authentication attempts followed by successful File Manager actions
- Requests without proper referrer headers
Network Indicators:
- Unusual outbound connections from Webmin server
- Requests to File Manager endpoints with suspicious parameters
SIEM Query:
source="webmin" AND (action="upload" OR action="delete" OR action="rename") AND referrer NOT CONTAINS "webmin"