CVE-2024-36451: Webmin Privilege Escalation Vulnerability

CVE-2024-36451 Overview

CVE-2024-36451 is an improper handling of insufficient permissions or privileges vulnerability in the ajaxterm module of Webmin versions prior to 2.003. An authenticated attacker with low privileges can hijack an active console session belonging to another user over the network. Successful exploitation allows the attacker to read sensitive system data, modify web content, or halt the underlying server. The vulnerability is tracked under CWE-280: Improper Handling of Insufficient Permissions or Privileges and was disclosed through the JVN #81442045 Advisory.

Critical Impact
Authenticated attackers can hijack Webmin console sessions to read system data, alter served content, or permanently halt the affected server.

Affected Products

Webmin versions prior to 2.003
Webmin ajaxterm module
Systems using Webmin for remote Unix/Linux administration

Discovery Timeline

2024-07-10 - CVE-2024-36451 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36451

Vulnerability Analysis

The ajaxterm module of Webmin provides a browser-based terminal that lets administrators run shell commands on the managed host. The module fails to correctly enforce ownership and access boundaries on active terminal sessions. An authenticated Webmin user can reference or attach to a console session that was initiated by a different user, bypassing the privilege separation the interface is intended to provide.

Because ajaxterm executes commands with the privileges of the session owner, hijacking a session that belongs to root or another administrative account effectively grants the attacker equivalent shell access. This turns a low-privilege Webmin account into a foothold for full host compromise, including data disclosure, defacement of Webmin-served content, and denial of service through shutdown or destructive commands.

Root Cause

The root cause is improper handling of insufficient permissions or privileges [CWE-280] within the ajaxterm session management logic. Session references are not adequately bound to the authenticated identity that created them, allowing another authenticated user to interact with a session they do not own.

Attack Vector

Exploitation requires network access to the Webmin interface and a valid low-privilege Webmin account. The attacker interacts with the ajaxterm module through crafted requests that target a console session belonging to a higher-privileged user. No user interaction from the victim is required beyond having an active session. See the JVN #81442045 Advisory for coordination details.

No public proof-of-concept or exploit code is currently listed for this CVE.

Detection Methods for CVE-2024-36451

Indicators of Compromise

Unexpected ajaxterm sessions active in Webmin under accounts that did not initiate them
Shell commands executed via Webmin from source IP addresses that do not match the session owner's normal access pattern
Anomalous entries in /var/webmin/miniserv.log and /var/webmin/webmin.log correlating multiple identities to the same terminal session
Privileged commands (user creation, service restarts, file modification) launched from ajaxterm outside of change windows

Detection Strategies

Monitor Webmin audit logs for ajaxterm module access by non-administrative users
Correlate authenticated Webmin usernames with source IP addresses to detect session takeover attempts
Alert on shell commands executed via ajaxterm when the invoking user does not normally use the terminal module
Track Webmin process spawning patterns for shells launched under identities that differ from the interactive login

Monitoring Recommendations

Ingest Webmin logs into a centralized SIEM or data lake for behavioral analysis
Enable operating system process auditing (auditd on Linux) to record child processes spawned by the Webmin daemon
Baseline normal ajaxterm usage per administrator and alert on deviations
Review Webmin user and module access control lists on a recurring schedule

How to Mitigate CVE-2024-36451

Immediate Actions Required

Upgrade Webmin to version 2.003 or later on all managed hosts
Disable the ajaxterm module in Webmin until the upgrade is applied
Restrict network access to the Webmin management port (default 10000/tcp) to trusted administrative networks only
Audit existing Webmin user accounts and remove or downgrade any that do not require console access

Patch Information

Webmin resolved the issue in version 2.003. Administrators should upgrade using the official packages available from the Webmin Official Site. After patching, verify the installed version through the Webmin dashboard or by running webmin --version on the host, and rotate credentials for any accounts that may have been exposed.

Workarounds

Disable the ajaxterm module through Webmin Configuration if upgrading is not immediately possible
Enforce strong, unique passwords and multi-factor authentication for all Webmin accounts
Place Webmin behind a VPN or jump host so that only authenticated administrators can reach the interface
Apply IP-based access controls in miniserv.conf to limit the source addresses permitted to authenticate

bash

# Configuration example: restrict ajaxterm and Webmin access
# 1) Disable the ajaxterm module for all users in /etc/webmin/webmin.acl
#    Remove 'ajaxterm' from each user/group line, then restart Webmin:
systemctl restart webmin

# 2) Restrict source networks in /etc/webmin/miniserv.conf
echo "allow=10.0.0.0/8 192.168.0.0/16" >> /etc/webmin/miniserv.conf
systemctl restart webmin

# 3) Verify the installed Webmin version is 2.003 or later
rpm -q webmin  || dpkg -l webmin