Poisoned Pipeline / Incidents / AS1
Webmin 1.890–1.920 build-server backdoor
Linux distro / packagesDeveloper workstation
In April 2018 an attacker exploited the Webmin development build server and
injected a concealed remote-command backdoor into password_change.cgi. The
change was taken from the local build tree, not from a controlled SCM, so
source review of git would not have seen it. Versions 1.890 shipped an
immediately exploitable root RCE; 1.900–1.920 still contained similar code
that became exploitable if “allow changing of expired passwords” was on.
In September 2018 the old build server was replaced, but the modified
directory was copied from backups and the backdoor returned. This was
deliberate, not an accidental bug. Tracked as CVE-2019-15107 / CVE-2019-15231.
Mapped techniques
- T0180 Compromise services / servers
- T0135 Vulnerable CICD system
- T0194 Outdated software components
- T0138 Backdoor in code
- T0191 Malicious code in artifacts
- T0172 Runtime backdoor
- T0201 Customers compromised
supply-chain Webmin build pipeline
The development build server was exploited in April 2018.
Infected code was taken from the local build tree, not from SCM.
The replacement CentOS 7 build host reused a backup of the poisoned
build directory, so the backdoor survived the “rebuild.”
Non-obvious RCE planted in password_change.cgi.
Released Webmin tarballs carried the backdoor to operators.
post-supply-chain Webmin customers
Root RCE for anyone who knew the trigger, on default 1.890.
Any server that installed the backdoored Webmin package.