Giving Root to the Web

[This article was contributed by Tom Owen]

These days, pretty much any box with an Ethernet port has a web administration interface running alongside the command line and that iffy SNMP agent. Even if you can ignore horrors like the admin password going through an HTML form and no support for HTTPS, it's unlikely that the web server running in, say, a cheap switch will have been better tested or reviewed than miniserv.pl, the perl HTTP server which runs at the core of Webmin.

Webmin is a popular administration package which provides form-based access to configuration files for many standard and optional components. Administrators use a browser and the Webmin forms to manage users DNS zone changes, driver modules and many other tasks. All the applications are perl modules, running via CGI under the miniserv.pl web server.

The recent vulnerability report from the LAC security lab suggests that miniserv.pl can be fooled by control characters in a web authentication string. It apparently needs the "Enable Password Timeout" option to be set in Webmin, but that's an option that many cautious admins will choose anyway. The inevitable exploit makes it concrete and easy. It's nicely set up to get a script kiddy going: a few lines of perl run netcat to fake a single HTTP GET. It's all simple and transparent except for an artfully crafted base64 string on the Authorization: header. The control codes there create a specific session for the default user "admin". A cookie containing the session ID on a local browser is then all the attacker needs to use all the Webmin modules. It's complete server root access with full havoc potential in a very few steps.

A search for "webmin" on Bugtraq shows a trickle of problems, mostly in the last couple of years, ranging from local privilege escalation to full remote admin access. Cross site scripting and other old favorites show up with oddities like leftover environment variables. In fact the the system seems more secure than many, but the consequences of failure are much worse than for ordinary web applications: instead of one function or application being compromised, it's the whole server. This situation raises a question: Can it ever be responsible to put a root function on to a web protocol?

This isn't particularly a Webmin issue. The miniserve.pl fault was promptly fixed in 1.070 but all of those cheap printers, switches and wireless access points are still booting the firmware they shipped with. We can be sure that this is a case where absence of reports doesn't mean the holes aren't there. Despite the potential for trouble, no reduction in web-based administration, even over the public internet, is going to happen soon. It probably won't even begin to happen until someone gets sued for negligence -- it's just too useful, and for remotely-hosted servers it's pretty much essential.

Just looking at Webmin, the value stands out:

• So many people hate text mode configuration
• Even those who love it acknowledge that systems like Bind are ticklish to get right by hand: A display like this is not lovely, but it can save you from forgetting the reverse addresses.
• Checklist purchasers need it: it's a good, demonstrable counterargument to "Linux is impossible to administer" charges.

So, lots of admins will be keeping Webmin, SWAT and those network boxes. They've got a lot of the same work to do:

• Turn off unused web administrator systems (and SNMP too.) Scan to make sure they stay off.
• When it's configurable, standardise on a web administration port to block unconditionally at the firewall. Caldera, for example, uses port 1000.
• Printers and switches don't need Internet access. At the firewall, block the IP range they're in.
• In simple LANs they don't even need a default gateway. 0.0.0.0 is fine.
• Webmin and others offer IP-based access control. Turn it on and only include administrators' machines.
• In the longer term, get that VPN on-line.

It's a shame. That fantasy about doing your work from the Internet cafe just ended. Web administration is democratic, convenient and inclusive, a huge boon to admins, and it'll be hard to give it up. But the way it looks now, it's hard to believe it can ever be really safe.

---

(Log in to post comments)