Backdoor found in Webmin, a popular web-based utility for managing Unix servers

guest · Aug 19, 2019

Backdoor found in Webmin, a popular web-based utility for managing Unix servers
Backdoored Webmin versions were available for download for more than a year through the official site
August 19, 2019
https://www.zdnet.com/article/backd...-web-based-utility-for-managing-unix-servers/

The backdoor mechanism would allow a remote attacker to execute malicious commands with root privileges on the machine running Webmin. Once this machine is compromised, an attacker could then use it to launch attacks on the systems managed through Webmin.
OVER ONE MILLION WEBMIN INSTALLS ARE VULNERABLE
The attack surface is enormous -- without taking machines managed through Webmin into account. On its GitHub page, the Webmin team claims their application has "over 1,000,000 installations worldwide." A Shodan search query returns over 215,000 public Webmin instances, which can be attacked without needing to compromise internal networks or to bypass firewalls to reach a Webmin installation.
WEBMIN BLAMES "COMPROMISED BUILD INFRASTRUCTURE"
According to one of the Webmin developers, the vulnerability was not the result of a coding mistake, but was actually "malicious code injected into compromised build infrastructure."

According to the Webmin team, all versions between 1.882 to 1.921 downloaded from Sourceforge contained the malicious backdoor code.
Click to expand...

Log in or Sign up

Backdoor found in Webmin, a popular web-based utility for managing Unix servers

guest Guest

Log in or Sign up

Backdoor found in Webmin, a popular web-based utility for managing Unix servers

guest Guest

Useful Searches