A year-old Webmin backdoor revealed at DEF CON 2019 allowed unauthenticated attackers to execute commands with root privileges on servers
Earlier this month, at DEF CON 2019, a Turkish security researcher, Özkan Mustafa Akkuş presented a zero-day remote code execution vulnerability in Webmin, a web-based system configuration system for Unix-like systems. Following this disclosure, its developers revealed that the backdoor was found in Webmin 1.890. A similar backdoor was also detected in versions 1.900 to 1.920.
The vulnerability was found in a Webmin security feature that allows an administrator to enforce a password expiration policy for other users’ accounts. The security researcher revealed that the vulnerability was present in the password reset page. It allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges on affected servers. They just need to add a simple pipe command (“|”) in the old password field through POST requests. This vulnerability is tracked as CVE-2019-15107.
The Webmin zero-day vulnerability was no accident
Jamie Cameron, the author of Webmin, in a blog post talked about how and when this backdoor was injected. He revealed that this backdoor was no accident, and was in fact, injected deliberately in the code by a malicious actor. He wrote, “Neither of these were accidental bugs – rather, the Webmin source code had been maliciously modified to add a non-obvious vulnerability,” he wrote.
The traces of this backdoor goes back to April 2018 when the development build server of Webmin was exploited and a vulnerability was introduced to the ‘password_change.cgi’ script. The team then reverted this file to its checked-in version from GitHub. The attacker again modified this file in July 2018. However, this time they added the exploit to code that executed only when changing of expired passwords was enabled. The team then replaced the vulnerable build server with a new server running CentOS7 in September 2018. But, this also did not solve the problem because the build directory that had the modified file was copied across from backups made on the original server.
After being informed about the zero-day exploit on 17th August 2019, the team released an updated version of Webmin 1.930 and Usermin version 1.780 addressing the vulnerabilities. These releases also address cross-site scripting (XSS) vulnerabilities that were disclosed by a different security researcher.
In order to ensure that such attacks are not repeated in the future the team is taking a few steps:
- Updating the build process to use only checked-in code from Github, rather than a local directory that is kept in sync.
- Rotated all passwords and keys accessible from the old build system.
- Auditing all GitHub check-ins over the past year to look for commits that may have introduced similar vulnerabilities.
To know more in detail, check out the official announcement by Webmin.
Attackers are exploiting vulnerabilities revealed at DEF CON and Black Hat
A ZDNet report posted last week, revealed that attackers are now exploiting the vulnerabilities that were made public earlier this month. Bad Packet reported on Twitter that it detected several “active exploitation attempts” by attackers on Friday.
CVE-2019-15107 (Webmin RCE) exploit attempts detected since 2019-08-21T21:33:21Zhttps://t.co/ZE6wNPfIcX#threatintel
— Bad Packets Report (@bad_packets) August 23, 2019
Many attackers are also targeting vulnerabilities in Pulse Secure VPN and Fortinet’s FortiGate VPN. Some of these vulnerabilities were discussed in a Black Hat talk named ‘Infiltrating Corporate Intranet Like NSA: Pre-auth RCE on Leading SSL VPNs.’
Bad Packets in a blog post shared that its honeypots have detected an “opportunistic mass scanning activity” targeting Pulse Secure VPN server endpoints vulnerable to CVE-2019-11510. This vulnerability discloses sensitive information using which unauthenticated attackers can get access to private keys and user passwords.
⚠️ 𝗪𝗔𝗥𝗡𝗜𝗡𝗚 ⚠️
Mass scanning activity detected from 2.137.127.2 (🇪🇸) checking for @pulsesecure Pulse Connect Secure VPN endpoints vulnerable to arbitrary file reading (CVE-2019-11510).#threatintel pic.twitter.com/fiRUMKjwbE— Bad Packets Report (@bad_packets) August 22, 2019
Security researcher, Kevin Beaumont tweeted that hackers are scanning the internet for vulnerable devices to retrieve VPN session files from Fortinet’s FortiGate.
Fortigate Fortinet SSL VPN is being exploited in the wild since last night at scale using 1996 style ../../ exploit – if you use this as a security boundary, you want to patch ASAP https://t.co/IaBSqZJ9iS
— Kevin Beaumont (@GossiTheDog) August 22, 2019
Read Next
Puppet launches Puppet Remediate, a vulnerability remediation solution for IT Ops
- Researchers find a new Linux vulnerability that allows attackers to sniff or hijack VPN connections
- TrueDialog’s unprotected database exposes millions of SMS messages containing two-factor codes, and more
- An unsecured Elasticsearch server exposed 1.2 billion user records containing their personal and social information
*** This is a Security Bloggers Network syndicated blog from Security News – Packt Hub authored by Bhagyashree R. Read the original post at: https://hub.packtpub.com/a-year-old-webmin-backdoor-revealed-at-def-con-2019-allowed-unauthenticated-attackers-to-execute-commands-with-root-privileges-on-servers/
