CVE-2019-15107: Webmin Command Injection Vulnerability

CVE-2019-15107 is a command injection vulnerability in Webmin, specifically in the old parameter of password_change.cgi. It allows an attacker to inject and run operating-system commands through that parameter. Because Webmin is a web-based system administration interface, successful abuse can give an attacker control over the underlying host. CISA notes known ransomware use of this vulnerability, so organizations running Webmin should treat it as a high-priority exposure until they confirm they are patched.

How it works

The flaw is classified as CWE-78 (OS Command Injection). In this class of weakness, user-supplied input is passed to a shell or command interpreter without adequate sanitization or escaping. According to the CISA summary, the parameter named old in password_change.cgi is the injection point. An attacker who can reach that CGI endpoint and supply a crafted value for old can cause the Webmin process to execute arbitrary commands with the privileges of the Webmin service. Exact request format, authentication requirements, and payload construction are not detailed in the provided facts; defenders must confirm those mechanics against the vendor advisory. The practical result is remote code execution on the host that runs Webmin, which can then be used for persistence, lateral movement, or deployment of ransomware.

Am I affected? How to find it in your systems

Webmin is commonly installed on Linux and Unix-like servers to provide browser-based administration of users, services, packages, and network settings. It may be exposed on an internal management network or, less securely, on the public internet. Inventory steps:

• Search package managers, configuration-management databases, and container images for the Webmin package or the webmin service.
• Look for listening ports typically associated with Webmin (commonly a high TCP port such as 10000) and for processes named miniserv.pl or similar Webmin binaries.
• Review web-server or reverse-proxy configurations that forward traffic to Webmin.
• Confirm the installed version and whether password_change.cgi is present and reachable; compare against the fixed versions listed in the vendor advisory.

Telemetry that may indicate exploitation includes unusual command execution spawned by the Webmin process, unexpected outbound connections from the Webmin host, authentication or CGI access logs showing anomalous values in the old parameter, and creation of new administrative users or scheduled tasks shortly after Webmin activity. Because public detail on exact indicators is limited, treat any unexplained shell activity originating from the Webmin user as suspicious and investigate.

How to remediate

The primary action is to apply the vendor-supplied update that addresses CVE-2019-15107. CISA’s required action is simply “Apply updates per vendor instructions.” After patching:

• Restart the Webmin service and verify the new version is running.
• Restrict Webmin access to trusted management networks or jump hosts via firewall rules or VPN.
• Disable or remove any unused CGI modules, including password-change functionality if it is not required.
• Run Webmin under a dedicated, least-privilege account rather than root when the product allows it.
• Enable and forward Webmin and system audit logs to a central SIEM for ongoing review.

Confirm the exact patch level and any post-update configuration steps directly from the vendor advisory before declaring the environment remediated.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Block external and unnecessary internal access to the Webmin port at the network firewall or host-based firewall.
• Place a reverse proxy or web application firewall in front of Webmin and add rules that reject or sanitize unexpected content in parameters such as old; treat this as virtual patching only, not a permanent fix.
• If password-change functionality is not required, disable or remove password_change.cgi and related modules.
• Increase monitoring: alert on process creation by the Webmin user, on modifications to critical system files, and on any use of the password-change endpoint.
• Segment the host so that compromise of Webmin cannot immediately reach domain controllers, backup servers, or other high-value assets.

These measures lower risk but do not eliminate the vulnerability; schedule patching as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities, especially those with known ransomware use, frequently lead to data theft or encryption. If Webmin was reachable and unpatched during the period of exposure, assume the host and any credentials or data it could access may be compromised. Rotate credentials, review accounts for unauthorized changes, and examine backups for integrity. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether associated accounts have appeared in prior incidents.