An authenticated OS command injection vulnerability in the Webmin Squid module allows an attacker with specific permissions to execute arbitrary commands on the host system.

The vulnerability exists in the cachemgr.cgi component of the Squid module, which fails to neutralize special characters in arguments. An attacker requires authenticated access to Webmin and specific Cache Manager permissions (the cms security option) to trigger the injection.

The vulnerability carries a CVSS score of 8.5, reflecting its potential for total system compromise. Successful exploitation allows an authenticated attacker to execute arbitrary commands with the privileges of the Webmin process, potentially leading to unauthorized data access, system disruption, or full lateral movement within the network.

Immediate Action: Update Webmin to version 2.600 or later, which includes the necessary security patches to properly quote arguments and prevent command injection.

Proactive Monitoring: Review Webmin access logs for unusual activity associated with the Squid module or attempts to execute system-level commands through the administrative interface.

Compensating Controls: Restrict access to the Webmin interface to trusted IP addresses and disable the Cache Manager feature or the Squid module if they are not required for current operations.

Public Exploit Available: Unknown

Given the High severity of this flaw, administrators should prioritize updating Webmin to version 2.600 immediately. Organizations that cannot update should restrict access to the affected module and perform a thorough audit of user permissions to minimize the attack surface.