CVE-2019-15107

What is Webmin?

Webmin is a widely used web-based administration panel for Unix-like systems, allowing administrators to manage users, disk quotas, services, firewall rules, and more through a browser instead of the command line. Its broad feature set and long history mean it's deployed on a large number of internet-facing servers, particularly smaller web hosts and self-managed VPS instances.

Overview

CVE-2019-15107 is a critical, unauthenticated remote command injection vulnerability caused by a backdoor planted in Webmin's own source code. The old parameter in password_change.cgi is passed unsanitized into a shell command, allowing an unauthenticated remote attacker to execute arbitrary commands as root simply by sending a crafted HTTP request to a Webmin instance with password-reset functionality enabled — no valid credentials required. CVSS 3.1 base score 9.8 (Critical).

Technical Details

This is CWE-78 (OS Command Injection). Investigation after disclosure revealed the injected code was not an accidental bug but a deliberate backdoor inserted into Webmin's build/distribution package (versions 1.882 through 1.921) via a compromised build server, rather than through the project's public source repository — meaning code review of the GitHub source would not have revealed it. The backdoor allowed the old password field, normally used during a self-service password change/reset flow, to be abused to inject and execute shell commands directly as root, with no authentication needed if the password-reset feature was enabled.

Discovery

Security researcher Özkan Mustafa Akkuş publicly disclosed the vulnerability at DEF CON 27 in August 2019, demonstrating exploitation live. The Webmin project subsequently confirmed the code had been maliciously inserted into build artifacts and was not present in the official GitHub source, and released a fixed version (1.930) removing the backdoor.

Exploitation Context

CISA added this to the KEV catalog in March 2022. The bug was mass-exploited almost immediately after disclosure — a Metasploit module was published within days, and internet-wide scanning for vulnerable Webmin instances began quickly given the trivial, unauthenticated nature of the exploit and Webmin's large internet-facing install base.

Remediation

1. Upgrade to Webmin 1.930 or later immediately — earlier versions in the 1.882–1.921 range contain the backdoored code regardless of source-code review status.
2. Disable the password-reset/password-change feature if upgrading is not immediately possible, as this removes the vulnerable code path.
3. Restrict network access to the Webmin management interface to trusted IP ranges or a VPN — it should never be exposed directly to the internet.
4. Audit systems for signs of prior compromise (unexpected root processes, added user accounts, cron jobs) if an internet-facing Webmin instance was running an affected version.
5. Rotate credentials and review logs for any unauthenticated password-reset requests during the exposure window.