CVE-2024-36450

Executive Summary

CVE-2024-36450 is a stored cross-site scripting (XSS) vulnerability in the sysinfo.cgi component of Webmin versions prior to 1.910. This flaw allows an attacker to inject arbitrary scripts into the system information page, which are then executed in the context of any user viewing that page. Successful exploitation could lead to session hijacking, web page defacement, or denial of service. The vulnerability is unpatched in older versions, and no public proof-of-concept or exploit code is currently available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

Supply Chain & Package Security

Webmin is a web-based system administration tool commonly deployed on Linux/Unix servers. This vulnerability does not directly affect package registries (NPM, PyPI, Go, Ruby), but it impacts the integrity of the Webmin software supply chain. Administrators should verify the integrity of their Webmin installation and ensure they are using a trusted source for updates.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored) Vector: UNKNOWN

While no official CVSS vector is provided, based on the description, a reasonable assessment would be:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires an authenticated user to view the page
• User Interaction: Required (UI:R) – victim must visit the sysinfo page
• Scope: Changed (S:C) – vulnerable component impacts the browser
• Confidentiality: Low (C:L) – session ID theft possible
• Integrity: Low (I:L) – page alteration possible
• Availability: Low (A:L) – server halt possible

Threat Level: Medium (if scored, likely 6.1)

Deep Dive & Mechanics

The vulnerability resides in the sysinfo.cgi script, which displays system information. The script fails to properly sanitize user-supplied input before rendering it in the HTML output. An attacker with access to modify system information (e.g., hostname, OS details) can inject malicious JavaScript code. When an administrator or other user accesses the sysinfo page, the injected script executes in their browser.

Attack Flow:

1. Attacker gains low-privileged access to Webmin (e.g., via stolen credentials or another vulnerability).
2. Attacker modifies a system parameter (e.g., hostname) to include a malicious payload: <script>alert('XSS')</script>.
3. Administrator visits the sysinfo page.
4. The injected script executes, stealing session cookies or performing other actions.

Root Cause: Lack of output encoding in sysinfo.cgi when displaying user-controlled data.

Vulnerable vs. Patched Code

Vulnerable Code (Webmin < 1.910):

# In sysinfo.cgi
print "<tr><td>Hostname</td><td>$hostname</td></tr>";

The $hostname variable is directly interpolated into HTML without sanitization.

Patched Code (Webmin >= 1.910):

# In sysinfo.cgi
use HTML::Entities;
print "<tr><td>Hostname</td><td>" . encode_entities($hostname) . "</td></tr>";

The patched version uses HTML::Entities::encode_entities() to escape HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to Webmin with at least "System Information" view permissions.
• Ability to modify system parameters (e.g., via "System Hostname" setting).

Exploitation Steps:

1. Log in to Webmin as a user with permission to change system settings.
2. Navigate to Webmin > System Hostname.
3. Set the hostname to: ";alert('XSS');//
4. Save changes.
5. Trigger the sysinfo page by navigating to Webmin > System Information.
6. The injected script executes in the browser.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team (Defender)

Detection:

• Monitor Webmin logs for unusual changes to system hostname or other parameters.
• Look for HTTP requests to /sysinfo.cgi with suspicious query strings.
• Use WAF rules to block common XSS payloads in Webmin requests.

Hunting:

• Search for <script> tags in Webmin configuration files.
• Review recent changes to /etc/webmin/ configuration.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /sysinfo.cgi containing <script> or onerror= patterns.
• File: Modified /etc/webmin/hostname or similar files containing JavaScript.
• Log: Webmin audit logs showing unexpected changes to system parameters.
• Behavior: Unexplained session ID theft or page defacement.

Detection Engineering

YARA Rule

rule CVE_2024_36450_Webmin_XSS {
    meta:
        description = "Detects XSS payloads in Webmin sysinfo.cgi"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36450"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Webmin sysinfo.cgi XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in Webmin sysinfo.cgi requests
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/sysinfo.cgi'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of script tags in system info (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36450 Webmin sysinfo.cgi XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/sysinfo.cgi"; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Webmin to version 1.910 or later.
2. If upgrade is not possible, restrict access to the sysinfo.cgi page using firewall rules or .htaccess.
3. Implement a Web Application Firewall (WAF) to block XSS payloads.

Long-term:

• Enforce input validation and output encoding for all user-controlled data.
• Conduct regular security audits of Webmin configurations.
• Monitor for CVE updates and apply patches promptly.

Workaround:

• Disable the sysinfo.cgi script by removing execute permissions: chmod -x /usr/libexec/webmin/sysinfo.cgi

Report generated by Valters IT DevSecOps AI Assistant