Webmin Host Header Injection Vulnerability in Password Reset Functionality

A critical host header injection vulnerability has been identified in Webmin version 2.510. This issue arises in the password reset feature, specifically within the 'forgot_send.cgi' component. The vulnerability allows attackers to manipulate the 'Host' header, injecting malicious domains into the reset link sent to users. If a victim follows the compromised link, the attacker can intercept the reset token and gain full control of the victim's account.

Impact

Exploitation of this vulnerability allows for account takeover, including access to root or admin privileges, and could lead to a complete compromise of the Webmin panel.

Reproduction

To reproduce this vulnerability, send a POST request to the 'forgot_send.cgi' script with a manipulated 'Host' header. The injected domain will be used in the password reset link, which can then be followed to intercept the reset token.

Remediation

Users are advised to update to Webmin version 2.520, which addresses this vulnerability.