Webmin Squid Module Cache Manager Argument Quoting Vulnerability

A vulnerability exists in Webmin versions prior to 2.600 within the Squid module's Cache Manager feature. The issue arises because the 'cachemgr.cgi' file does not properly quote command-line arguments. This vulnerability is relevant for authenticated users with specific Cache Manager permissions.

Impact

Exploitation of this vulnerability could lead to command injection, allowing an authenticated user to execute arbitrary commands on the server.

Reproduction

To reproduce this vulnerability, an authenticated user with the 'cms' security option must access the Squid module's Cache Manager feature. The user can then send a request that includes unquoted arguments, which the server will execute, potentially leading to command injection.

Remediation

Users can upgrade to Webmin version 2.610 or later, where this vulnerability has been fixed.