Webmin Directory Traversal Vulnerability
BID:3698
Info
Webmin Directory Traversal Vulnerability
| Bugtraq ID: | 3698 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-1196 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 17 2001 12:00AM |
| Updated: | Jul 11 2009 09:06AM |
| Credit: | This vulnerability was submitted in a December 17th, 2001 BugTraq posting by A. Ramos <[email protected]>. |
| Vulnerable: |
Webmin Webmin 0.91 |
| Not Vulnerable: | |
Discussion
Webmin Directory Traversal Vulnerability
Webmin is a web-based interface for system administration for Unix. Using any browser that supports tables and forms, you can setup user accounts, Apache, DNS, file sharing and so on. Webmin will run on most Unix variants, providing it has been properly configured.
Webmin does not adequately filter '../' sequences from web requests, making it prone to directory traversal attacks. Furthermore, since Webmin is a facility for remote web-based administration of Unix systems, it requires root privileges. This vulnerability could be exploited to effectively disclose any file on a host running the affected software.
It may also be possible to edit files or place files on the server. This may lead to a remote root compromise.
Webmin is a web-based interface for system administration for Unix. Using any browser that supports tables and forms, you can setup user accounts, Apache, DNS, file sharing and so on. Webmin will run on most Unix variants, providing it has been properly configured.
Webmin does not adequately filter '../' sequences from web requests, making it prone to directory traversal attacks. Furthermore, since Webmin is a facility for remote web-based administration of Unix systems, it requires root privileges. This vulnerability could be exploited to effectively disclose any file on a host running the affected software.
It may also be possible to edit files or place files on the server. This may lead to a remote root compromise.
Exploit / POC
Webmin Directory Traversal Vulnerability
The following example was submitted by A. Ramos <[email protected]>:
http://www.domain.com:10000/servers/link.cgi/1008341480/init/edit_action.cgi?0+../../../../../etc/shadow
The following example was submitted by A. Ramos <[email protected]>:
http://www.domain.com:10000/servers/link.cgi/1008341480/init/edit_action.cgi?0+../../../../../etc/shadow
Solution / Fix
Webmin Directory Traversal Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.