In the package , which provides tools for remote server management, a backdoor (), discovered in the official builds of the project, through Sourceforge and on the main site. The backdoor was present in builds from 1.882 to 1.921 inclusive (the code with the backdoor was not in the git repository) and allowed arbitrary shell commands to be executed in the system with root privileges without authentication.
For an attack, it is sufficient to have an open network port with Webmin and activity in the web interface of the outdated password change function (enabled by default in builds 1.890, but disabled in other versions). The issue downward API support (simultaneously with this in 1.930. As a temporary measure to block the backdoor, it is enough to remove the setting "passwd_mode=" from the configuration file /etc/webmin/miniserv.conf. A test has been prepared .
The issue was in the script password_change.cgi, in which the function unix_crypt is called to check the old password entered in the web form with the received user password passed to it without escaping special characters. In the git repository, this function is wrapped over the Crypt::UnixCrypt module and poses no danger, but in the archive with the code provided on the Sourceforge site, code is called that directly accesses /etc/shadow, but does this using shell construction. To attack, it is enough to enter the character "|" in the old password field, and the subsequent code will be executed with root privileges on the server.
According to Webmin developers, the malicious code was inserted as a result of compromising the project's infrastructure. Details are not yet disclosed, so it is unclear whether the hack was limited to seizing control of the account on Sourceforge or affected other elements of the Webmin development and build infrastructure. The malicious code was present in the archives since March 2018. The issue also affected . All bootable archives have now been rebuilt from Git.
Source: opennet.ru
