CVE-2020-35606: Webmin Package Updates RCE Vulnerability

CVE-2020-35606 Overview

CVE-2020-35606 is a command injection vulnerability affecting Webmin through version 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A (newline) and %0C (form feed) URL-encoded characters. This vulnerability represents an incomplete fix for CVE-2019-12840, allowing attackers to bypass the original security patches.

Critical Impact

Authenticated attackers can achieve arbitrary command execution with root privileges, potentially leading to complete system compromise of servers running affected Webmin versions.

Affected Products

• Webmin versions through 1.962
• Webmin Package Updates module
• All installations with the Package Updates module enabled

Discovery Timeline

• 2020-12-21 - CVE-2020-35606 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-35606

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists within the Package Updates module of Webmin, which is commonly used by system administrators to manage software packages on Linux and Unix systems.

The vulnerability arises from the application's failure to properly sanitize user-controlled input before passing it to shell commands executed with elevated privileges. This is particularly concerning as Webmin typically runs with root privileges to perform administrative functions.

Root Cause

The root cause of CVE-2020-35606 stems from an incomplete remediation of the earlier CVE-2019-12840 vulnerability. While the original fix attempted to prevent command injection through input sanitization, the implementation failed to account for URL-encoded newline (%0A) and form feed (%0C) characters.

These special characters allow attackers to inject additional commands by breaking out of the intended command context. When decoded, %0A becomes a newline character that can terminate the current command and begin a new one, while %0C (form feed) can similarly be used to manipulate command parsing.

Attack Vector

The attack vector requires network access and valid authentication credentials for a user account with access to the Package Updates module. Once authenticated, the attacker can craft malicious HTTP requests containing URL-encoded special characters (%0A and %0C) that bypass input validation filters.

When the Package Updates module processes these requests, the injected commands are executed by the underlying shell with root privileges. This can result in complete system compromise, as the attacker gains the ability to execute any arbitrary command with the highest privilege level on the system.

The attack does not require user interaction beyond the initial authentication, and the complexity is low since public exploit code is available through Exploit-DB and Packet Storm Security.

Detection Methods for CVE-2020-35606

Indicators of Compromise

• HTTP requests to Webmin containing URL-encoded %0A or %0C characters in Package Updates module parameters
• Unexpected child processes spawned by the Webmin service process
• Unusual commands executed with root privileges shortly after Package Updates module access
• Log entries showing access to /package-updates/ endpoints with encoded special characters

Detection Strategies

• Monitor Webmin access logs for requests containing %0A or %0C encoded sequences
• Implement web application firewall (WAF) rules to detect and block command injection patterns
• Deploy SentinelOne agents to detect anomalous process execution chains originating from Webmin
• Enable process auditing to identify unexpected commands executed under the Webmin context

Monitoring Recommendations

• Configure alerting for any commands spawned by Webmin outside normal package management operations
• Implement network monitoring to detect suspicious outbound connections following Webmin authentication
• Review authentication logs for the Package Updates module to identify potential reconnaissance activity
• Enable verbose logging for Webmin to capture detailed request parameters for forensic analysis

How to Mitigate CVE-2020-35606

Immediate Actions Required

• Upgrade Webmin to a version newer than 1.962 that includes the complete fix for this vulnerability
• Restrict access to the Package Updates module to only essential administrative accounts
• Implement network segmentation to limit Webmin accessibility to trusted management networks
• Enable two-factor authentication for Webmin to add an additional layer of protection

Patch Information

The vendor has addressed this vulnerability in versions released after 1.962. Organizations should download the latest version from the Webmin Download Page and apply the update immediately. Given the availability of public exploit code on Exploit-DB, patching should be treated as a priority.

Workarounds

• Disable the Package Updates module if not required for operations until patching can be completed
• Implement strict IP-based access controls to limit Webmin access to trusted administrative hosts only
• Deploy a reverse proxy with input filtering to sanitize requests before they reach Webmin
• Consider temporarily disabling Webmin entirely if the system can be managed through alternative means

# Configuration example - Restrict Webmin access to specific IP addresses
# Add to /etc/webmin/miniserv.conf
allow=192.168.1.0/24 10.0.0.0/8