CVE-2022-36446
📋 TL;DR
CVE-2022-36446 is a command injection vulnerability in Webmin's apt-lib.pl module that allows remote attackers to execute arbitrary commands on affected systems. The vulnerability affects Webmin installations before version 1.997 and can be exploited through the package updates interface. Attackers can gain full control of the server by injecting malicious commands into the UI.
💻 Affected Systems
- Webmin
📦 What is this software?
Webmin by Webmin
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains root-level command execution, leading to complete system compromise, data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Authenticated attacker or attacker who gains access to Webmin interface executes arbitrary commands with Webmin's privileges, typically root, resulting in system takeover.
If Mitigated
With proper network segmentation and authentication controls, impact is limited to authenticated users only, reducing attack surface significantly.
🎯 Exploit Status
Multiple public exploit scripts available. Requires authentication to Webmin interface, but can be combined with other vulnerabilities or credential theft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.997
Vendor Advisory: https://github.com/webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bde
Restart Required: No
Instructions:
1. Backup Webmin configuration. 2. Update Webmin to version 1.997 or later using the built-in update feature or manual installation. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Package Updates Module
linuxTemporarily disable the vulnerable apt-lib.pl module until patching is possible
mv /usr/share/webmin/software/apt-lib.pl /usr/share/webmin/software/apt-lib.pl.disabled
Restrict Webmin Access
linuxLimit Webmin access to specific IP addresses only
Edit /etc/webmin/miniserv.conf and set allow=192.168.1.0/24 (replace with your network)
🧯 If You Can't Patch
- Implement strict network access controls to limit Webmin access to trusted IP addresses only
- Enable multi-factor authentication for all Webmin users and audit user accounts for unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check Webmin version: grep 'version=' /etc/webmin/miniserv.conf | cut -d= -f2. If version is less than 1.997, system is vulnerable.Check Version:
grep 'version=' /etc/webmin/miniserv.conf | cut -d= -f2Verify Fix Applied:
Verify Webmin version is 1.997 or higher using the same command. Check that the apt-lib.pl file contains proper HTML escaping for UI commands.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in Webmin logs
- Multiple failed authentication attempts followed by successful login
- Suspicious package update requests with unusual parameters
Network Indicators:
- Unusual outbound connections from Webmin server
- Traffic to known malicious IPs from Webmin host
- Unexpected SSH or reverse shell connections originating from Webmin
SIEM Query:
source="webmin" AND (command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*")🔗 References
- http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/168049/Webmin-Package-Updates-Command-Injection.html
- https://gist.github.com/emirpolatt/cf19d6c0128fa3e25ebb47e09243919b
- https://github.com/webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bde
- https://github.com/webmin/webmin/compare/1.996...1.997
- https://www.exploit-db.com/exploits/50998
- http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/168049/Webmin-Package-Updates-Command-Injection.html
- https://gist.github.com/emirpolatt/cf19d6c0128fa3e25ebb47e09243919b
- https://github.com/webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bde
- https://github.com/webmin/webmin/compare/1.996...1.997
- https://www.exploit-db.com/exploits/50998
