Docker-based lab demonstrating CVE-2019-15107, the Webmin unauthenticated RCE, covering deployment, exploitation, detection, and remediation.
This project demonstrates CVE-2019-15107, a critical Remote Code Execution (RCE) vulnerability in Webmin, within a controlled and isolated Docker environment. The lab covers the complete vulnerability lifecycle from deployment and exploitation to detection and remediation.
1.Docker Desktop (installed and running)
2.Docker Compose
3.Terminal / PowerShell with curl.exe support
1.OS (Local host environment)
2.Port Availability: Port 10000 must be free on the host machine.
1.Application: Webmin
2.Vulnerable Version: 1.910 (Affected versions: 1.880 to 1.920)
3.Fixed/Patched Version: 1.930 and above
4.Vulnerability Type: Improper Neutralization of Special Elements used in an OS Command (CWE-78)
5.CVSS Score: 9.8 (Critical)
1.Clone or download this project repository to your local machine.
2.Open your terminal and navigate to the project directory containing docker-compose.yml.
3.Ensure Docker Desktop is active on your system.
Run the following command from the project root directory to pull and start the vulnerable container in detached mode: docker-compose up -d
You can verify the container status by running: docker compose ps
Access the application interface in your web browser at: https://localhost:10000 (accept the local SSL certificate warning).
To stop and remove the running container environment, run: docker-compose down
The vulnerability exists in the unauthenticated password change endpoint (/password_change.cgi), where input parameters are passed directly to the system shell without proper sanitization.
Run the following command in your terminal (PowerShell/Bash) to execute a diagnostic command (id) as a proof-of-concept:
curl.exe -k https://localhost:10000/password_change.cgi -e "https://localhost:10000" -d "user=root&pam=&old=test|id&new1=test&new2=test"
Successful Exploitation: The server processes the injected pipe character (|), triggering unauthenticated command execution with root privileges. The terminal will output HTML response evidence alongside the container shell feedback (uid=0(root)), confirming successful remote code execution.
1.Version Identification: Inspecting the running Webmin instance version to verify if it falls within the vulnerable range (1.880 to 1.920).
2.Network / Log Monitoring: Inspecting web server access or WAF logs for incoming HTTP POST requests directed to /password_change.cgi containing suspicious shell control characters (such as | or ;) inside parameter values.
1.Upgrade: Upgrade Webmin to version 1.930 or higher, which properly sanitizes inputs passed to the underlying modules.
2.Access Control: Restrict network access to port 10000 using firewalls or VPN tunnels to prevent direct exposure to untrusted networks.
1.Docker Daemon Not Running: If you encounter connection errors, ensure Docker Desktop is fully started and verify using docker version.
2.Port Conflict (10000 already in use): Ensure no other local application or service is occupying port 10000.
3.PowerShell curl Syntax Error: Use curl.exe instead of standard curl in Windows PowerShell to avoid parameter mapping issues with PowerShell's built-in Invoke-WebRequest alias.
