Webmin CVE-2022-0824 Post-Auth Reverse Shell
Vulnerability Description
Webmin 1.984 and below – File Manager privilege exploit (CVE-2022-0824 and CVE-2022-0829)
Less privileged Webmin users who do not have any File Manager module restrictions configured can access files with root privileges, if using the default Authentic theme. All systems with additional untrusted Webmin users should upgrade immediately. Note that Virtualmin systems are not effected by this bug, due to the way domain owner Webmin users are configured.
Source: https://www.webmin.com/security.html
Exploit Description
This exploit takes advantage of the post-auth Improper Access Control vulnerability in File Manager. This exploit could be done by any less privileged authenticated attacker. It will download a .cgi file remotely from an attacker-controlled server and modify its permission to be a world-executables file. Once this is done, it will execute the .cgi file