CVE-2017-15644

published 2017-10-19

CVE-2017-15644: SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.

Priority P2 61 high 8.6 CVSS 3.0

AV N AC L PR N UI N S C C H I N A N

EXPLOIT

SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
webmin	webmin	<= 1.850	—

Detection & IOCs extracted from sources · hover to see the quote

url tunnel/link.cgi/http://INTRANET-IP:8000↗

path /tunnel/link.cgi↗

url http://x.x.x.x:10000/tunnel/link.cgi/http://VICTIM-IP:8000↗

port 10000↗

command GET /tunnel/link.cgi/http://<TARGET>:8000↗

• → Detect SSRF exploitation attempts by monitoring HTTP GET requests to Webmin's tunnel/link.cgi where the PATH_INFO contains an embedded http:// or https:// URL pointing to internal/intranet addresses. ↗
• → Alert on GET requests to /at/create_job.cgi containing the parameters 'user=root' and 'cmd=' which indicate CSRF-driven arbitrary command scheduling. ↗

• · The SSRF vulnerability is specific to Webmin version 1.850; patched versions are not affected. Verify the running Webmin version before applying detection rules to avoid false positives on patched deployments. ↗

CVSS provenance

nvd v3.0 8.6 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918