CVE-2025-61541: Webmin Auth Bypass Vulnerability

CVE-2025-61541 Overview

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.

Critical Impact

An attacker can hijack user accounts by intercepting password reset tokens through a poisoned link, potentially gaining full administrative access to Webmin installations.

Affected Products

• Webmin version 2.510
• Webmin forgot_send.cgi password reset component
• Systems using Webmin's email-based password recovery

Discovery Timeline

• 2025-10-16 - CVE CVE-2025-61541 published to NVD
• 2025-11-06 - Last updated in NVD database

Technical Details for CVE-2025-61541

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control) and represents a Host Header Injection flaw in Webmin's password reset mechanism. The core issue lies in how the forgot_send.cgi script constructs password reset URLs by directly utilizing the HTTP Host header through the get_webmin_email_url() function without proper validation or sanitization.

When a user requests a password reset, Webmin generates a reset link containing a sensitive token and sends it via email. The vulnerability allows an attacker to craft a malicious request with a manipulated Host header pointing to an attacker-controlled domain. The victim receives an email containing what appears to be a legitimate password reset link, but the URL actually directs to the attacker's server, enabling token interception.

Root Cause

The root cause stems from the get_webmin_email_url() function trusting user-controlled input (the HTTP Host header) when constructing password reset URLs. This function fails to validate that the Host header matches the legitimate Webmin server hostname, allowing arbitrary domain injection into security-sensitive email communications.

Attack Vector

The attack is network-based and requires user interaction. An attacker performs the following steps:

1. The attacker initiates a password reset request for a target user account
2. The attacker intercepts or crafts the request with a malicious Host header pointing to their controlled domain (e.g., attacker.com)
3. Webmin's forgot_send.cgi script processes the request and calls get_webmin_email_url() which uses the manipulated Host header
4. The victim receives an email with a password reset link pointing to attacker.com instead of the legitimate Webmin server
5. When the victim clicks the poisoned link, the reset token is sent to the attacker's server
6. The attacker uses the captured token to reset the victim's password and gain account access

The vulnerability mechanism involves the unsafe construction of password reset URLs using untrusted HTTP headers. The get_webmin_email_url() function extracts the Host header value and incorporates it directly into the reset link without validation. For technical details, refer to the GitHub Vulnerability Research documentation.

Detection Methods for CVE-2025-61541

Indicators of Compromise

• Unusual Host header values in web server access logs targeting /forgot_send.cgi
• Password reset emails containing unexpected or external domain URLs
• Failed login attempts or unauthorized password changes following reset requests
• Network traffic to unknown external domains during password reset workflows

Detection Strategies

• Monitor HTTP access logs for requests to forgot_send.cgi with non-standard Host headers that don't match the configured Webmin hostname
• Implement email security scanning to detect password reset emails with suspicious or external URLs
• Configure web application firewall (WAF) rules to detect and block requests with manipulated Host headers
• Review authentication logs for anomalous password reset patterns or successful logins following suspicious reset requests

Monitoring Recommendations

• Enable verbose logging for Webmin authentication events including password reset requests
• Set up alerts for password reset emails containing URLs that don't match the organization's Webmin server domain
• Monitor for multiple password reset requests originating from different IP addresses for the same user account
• Implement SIEM rules to correlate Host header anomalies with subsequent authentication events

How to Mitigate CVE-2025-61541

Immediate Actions Required

• Review and audit all Webmin installations to identify systems running version 2.510
• Implement Host header validation at the web server or reverse proxy level to reject requests with unexpected Host values
• Consider temporarily disabling the email-based password reset functionality until a patch is applied
• Alert users about potential phishing attempts involving password reset emails

Patch Information

Check the Webmin Official Site and the GitHub Webmin Repository for updated releases that address this vulnerability. Organizations should prioritize upgrading to a patched version of Webmin as soon as one becomes available.

Workarounds

• Configure your web server or reverse proxy to enforce strict Host header validation, accepting only the legitimate Webmin server hostname
• Implement a whitelist of allowed Host header values at the network perimeter or application layer
• Use multi-factor authentication to add an additional layer of protection even if password reset tokens are compromised
• Consider using alternative password reset mechanisms such as administrator-initiated resets until a vendor patch is available

# Example: Apache mod_headers configuration to validate Host header
# Add to Apache configuration to reject requests with unexpected Host headers
<IfModule mod_headers.c>
    # Replace 'webmin.yourdomain.com' with your actual Webmin hostname
    SetEnvIf Host "^webmin\.yourdomain\.com$" VALID_HOST
    <RequireAll>
        Require env VALID_HOST
    </RequireAll>
</IfModule>