Description
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| webmin | usermin | ≤ 2.570 | — |
References
- GitHub Issue #142 issue-tracking
- https://github.com/webmin/usermin product
- Fix commit 8a45420 patch
- delete_folder in mailbox-lib.pl technical-description
- Researcher write-up technical-description
- VulnCheck Advisory: Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion third-party-advisory