CVE-2024-36451

Executive Summary

CVE-2024-36451 is a critical vulnerability in the Webmin ajaxterm module, affecting versions prior to 2.003. The flaw stems from improper handling of insufficient permissions or privileges, allowing an unauthorized user to hijack a console session. Successful exploitation could lead to data exfiltration, webpage defacement, or a complete denial of service (DoS) on the affected server. The vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and CWE-276 (Incorrect Default Permissions). No public proof-of-concept (PoC) or exploit code has been released at this time, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, due to the widespread use of Webmin for server management, this vulnerability poses a significant risk to unpatched systems.

Supply Chain & Package Security

Webmin is a web-based system administration tool commonly deployed via package managers (e.g., APT, YUM) or direct download from the official website. The vulnerability exists in the ajaxterm module, which is a core component of Webmin. Organizations should verify the integrity of their Webmin installation by checking checksums or using signed packages from the official repository. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the description and impact, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Data can be accessed.
• Integrity (I): High (H) – Webpages can be altered.
• Availability (A): High (H) – Server can be halted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication required, and high impact on confidentiality, integrity, and availability makes this a severe threat.

Deep Dive & Mechanics

The ajaxterm module in Webmin provides a web-based terminal console. The vulnerability arises from improper permission checks when handling session requests. Specifically, the module fails to verify that the requesting user has the necessary privileges to access or hijack an existing console session. This allows an attacker to:

1. Session Hijacking: By sending crafted HTTP requests to the ajaxterm endpoint, an attacker can take over an active console session of another user (e.g., an administrator).
2. Unauthorized Access: Once hijacked, the attacker gains the same level of access as the legitimate user, potentially with root privileges.
3. Impact: The attacker can execute arbitrary commands, read/write files, modify web content, or crash the server.

The root cause is a missing or insufficient authorization check in the session management logic of the ajaxterm module. The module likely uses a session ID that is predictable or not properly bound to the user's authentication context.

Vulnerable vs. Patched Code

The following is a conceptual comparison based on the vulnerability description. Actual code may vary.

Vulnerable Code (Webmin < 2.003):

# In ajaxterm.cgi or similar
my $session_id = param('session');
# No check if the current user owns this session
my $session_data = get_session($session_id);
# Directly use the session without verifying ownership

Patched Code (Webmin >= 2.003):

# In ajaxterm.cgi or similar
my $session_id = param('session');
my $current_user = get_current_user();
my $session_data = get_session($session_id);
# Verify that the session belongs to the current user
if ($session_data->{user} ne $current_user) {
    error("Unauthorized session access");
}
# Proceed only if authorized

The patch adds a check to ensure the session being accessed belongs to the authenticated user, preventing hijacking.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, the following is a conceptual approach:

1. Identify Target: Scan for Webmin instances (default port 10000).
2. Enumerate Sessions: Use a script to brute-force or predict session IDs (if weak).
3. Hijack Session: Send a request to /ajaxterm/ with a stolen or guessed session ID.
4. Execute Commands: Once hijacked, execute arbitrary commands via the terminal.

Example Request (Conceptual):

POST /ajaxterm/ HTTP/1.1
Host: target:10000
Cookie: sid=STOLEN_SESSION_ID
Content-Type: application/x-www-form-urlencoded

command=whoami

Lab Setup:

• Install Webmin 2.002 on a virtual machine.
• Create two users: admin (with console session) and attacker (no privileges).
• Use Burp Suite or a custom script to attempt session hijacking.

Blue Team (Defense)

1. Patch Immediately: Upgrade to Webmin 2.003 or later.
2. Monitor Logs: Look for unusual access to /ajaxterm/ endpoints.
3. Session Monitoring: Detect multiple requests with the same session ID from different IPs.
4. Network Segmentation: Restrict access to Webmin to trusted networks only.

Indicators of Compromise (IOCs)

• Network:
  • Unusual HTTP requests to /ajaxterm/ with session IDs.
  • Multiple failed authentication attempts followed by successful session access.
• Host:
  • Unexpected processes spawned from the Webmin user.
  • Modified web files (e.g., /usr/share/webmin/).
  • System logs showing unauthorized command execution.
• Logs:
  • Webmin access logs showing repeated session ID usage.
  • /var/log/webmin/miniserv.log entries with ajaxterm errors.

Detection Engineering

YARA Rule

rule CVE_2024_36451_Webmin_Ajaxterm_Hijack {
    meta:
        description = "Detects potential exploitation of CVE-2024-36451 in Webmin ajaxterm module"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36451"
    strings:
        $s1 = "ajaxterm" nocase
        $s2 = "session" nocase
        $s3 = "command" nocase
    condition:
        all of them and filesize < 10KB
}

Sigma Rule

title: Webmin Ajaxterm Session Hijacking Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-36451 by hijacking ajaxterm sessions
author: Valters IT
logsource:
    category: webserver
    product: webmin
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/ajaxterm/'
        cs-uri-query|contains: 'session='
    condition: selection
falsepositives:
    - Legitimate admin usage
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36451 Webmin Ajaxterm Session Hijack Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ajaxterm/"; http_uri;
    content:"session="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Upgrade Webmin to version 2.003 or later. This is the only official patch.
2. Workaround: If patching is not possible, disable the ajaxterm module via Webmin's module configuration.
3. Access Control: Restrict access to Webmin using firewall rules (e.g., allow only specific IPs).
4. Monitoring: Enable detailed logging for Webmin and monitor for suspicious activity.
5. Least Privilege: Ensure Webmin users have minimal necessary permissions.

Valters IT