Path Traversal in Webmin and Usermin (CVE-2006-3392)

CVE-2006-3392 is a path traversal vulnerability affecting Webmin versions prior to 1.290 and Usermin versions prior to 1.220. The flaw resides in the 'simplify_path' function, which incorrectly processes path strings before HTML decoding. This logic allows attackers to bypass security filters - specifically the removal of '../' sequences - by using malformed input such as '..%01'.

Because the input is processed in a vulnerable order, the underlying filesystem treats the sequence as a directory traversal instruction, enabling remote, unauthenticated attackers to disclose arbitrary files with root privileges. Given the release of functional exploit scripts, attackers can easily retrieve sensitive system files, including /etc/passwd, /etc/shadow, and cryptographic keys (e.g., /root/.ssh/id_rsa), significantly facilitating subsequent unauthorized access and privilege escalation.

Impact

The successful exploitation of this vulnerability results in the full disclosure of arbitrary files from the affected server. In environments where Webmin or Usermin are configured to run as root, this leads to complete information compromise, including the retrieval of local password hashes and private SSH keys, which can be leveraged to gain persistent administrative access to the host.

Recommendation

Prioritize patching or decommissioning legacy instances of Webmin and Usermin identified as vulnerable.

• Upgrade Webmin to version 1.290 or later, and Usermin to version 1.220 or later, to remediate the vulnerable 'simplify_path' logic.
• Audit network logs for requests containing the '..%01' sequence or other anomalous traversal patterns directed at Webmin or Usermin management ports (typically 10000).
• Inspect server access logs for repeated successful HTTP 200 responses to requests targeting sensitive system files like /etc/passwd or .ssh directories.
• Implement network-level restrictions to ensure management interfaces are not exposed to the public internet, as the vulnerability is exploitable by remote, unauthenticated actors.