CVE-2024-45692
📋 TL;DR
This vulnerability allows attackers to create a network traffic loop via spoofed UDP packets on port 10000, causing denial of service. It affects Webmin and Virtualmin installations before specific versions. Systems with these services exposed to untrusted networks are at risk.
💻 Affected Systems
- Webmin
- Virtualmin
📦 What is this software?
Virtualmin by Virtualmin
Webmin by Webmin
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the Webmin/Virtualmin service and potentially network exhaustion affecting other services on the same host or network segment.
Likely Case
Service disruption for Webmin/Virtualmin management interface, preventing administrative access.
If Mitigated
Limited impact if proper network segmentation and access controls are in place to restrict UDP traffic to port 10000.
🎯 Exploit Status
Exploitation requires sending specially crafted UDP packets to port 10000. The technique is documented in the Loop DoS research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Webmin 2.202, Virtualmin 7.20.2
Vendor Advisory: https://webmin.com
Restart Required: Yes
Instructions:
1. Update Webmin: sudo apt update && sudo apt upgrade webmin
2. Update Virtualmin: Use Virtualmin's built-in update system or package manager
3. Restart Webmin service: sudo systemctl restart webmin
🔧 Temporary Workarounds
Block UDP traffic on port 10000
linuxPrevent UDP packets from reaching the vulnerable service using firewall rules
sudo iptables -A INPUT -p udp --dport 10000 -j DROP
sudo iptables -A INPUT -p udp --dport 10000 -j REJECT
Restrict access to trusted networks
linuxLimit Webmin/Virtualmin access to specific IP addresses or networks
sudo iptables -A INPUT -p tcp --dport 10000 -s TRUSTED_IP -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 10000 -j DROP
🧯 If You Can't Patch
- Implement strict firewall rules to block all UDP traffic to port 10000 from untrusted sources
- Consider moving Webmin/Virtualmin to an internal network segment with restricted access
🔍 How to Verify
Check if Vulnerable:
Check Webmin version: cat /etc/webmin/version
Check Virtualmin version: virtualmin versionCheck Version:
webmin --version 2>/dev/null || cat /etc/webmin/versionVerify Fix Applied:
Verify version is Webmin >= 2.202 or Virtualmin >= 7.20.2
Test UDP connectivity to port 10000 is blocked or properly handled📡 Detection & Monitoring
Log Indicators:
- Unusual UDP traffic spikes on port 10000 in firewall logs
- Webmin service restart/crash logs
Network Indicators:
- High volume of UDP packets to port 10000 from multiple sources
- Network performance degradation
SIEM Query:
source_port:10000 AND protocol:UDP AND (packet_count > 1000 OR bytes > 1000000)