{"id":46270,"date":"2025-05-08T17:46:48","date_gmt":"2025-05-08T10:46:48","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=46270"},"modified":"2025-06-10T17:47:30","modified_gmt":"2025-06-10T10:47:30","slug":"phat-hien-lo-hong-nghiem-trong-trong-webmin-cho-phep-chiem-quyen-dieu-khien-tu-xa","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/phat-hien-lo-hong-nghiem-trong-trong-webmin-cho-phep-chiem-quyen-dieu-khien-tu-xa\/","title":{"rendered":"Ph\u00e1t hi\u1ec7n l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong Webmin cho ph\u00e9p chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa"},"content":{"rendered":"<p class=\"mt-3 excerpt\">M\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nguy hi\u1ec3m v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong Webmin \u2013 c\u00f4ng c\u1ee5 qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng t\u1eeb xa ph\u1ed5 bi\u1ebfn tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 Linux\/Unix cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 leo thang \u0111\u1eb7c quy\u1ec1n v\u00e0 th\u1ef1c thi m\u00e3 t\u1eeb xa n\u1ebfu khai th\u00e1c th\u00e0nh c\u00f4ng. L\u1ed7 h\u1ed5ng n\u00e0y \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 c\u00f3 m\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng cao v\u1edbi \u0111i\u1ec3m CVSS 8.8 v\u00e0 \u0111\u00e3 \u0111\u01b0\u1ee3c g\u00e1n m\u00e3 \u0111\u1ecbnh danh l\u00e0 CVE-2025-2774.<\/p>\n<div id=\"relatedPost\" class=\"mt-3 mb-3\">\n<div class=\"\">\n<ul class=\"ms-2\">\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"L\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong Commvault c\u00f3 th\u1ec3 d\u1eabn t\u1edbi chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t h\u1ec7 th\u1ed1ng\">L\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong Commvault c\u00f3 th\u1ec3 d\u1eabn t\u1edbi chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t h\u1ec7 th\u1ed1ng<\/li>\n<\/ul>\n<\/li>\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"Ph\u00e1t hi\u1ec7n l\u1ed7 h\u1ed5ng m\u00e3 ngu\u1ed3n b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng x\u1eed l\u00fd ng\u00f4n ng\u1eef Nature v\u00e0 m\u1ea1ng \u0111\u1ed3 th\u1ecb s\u00e2u\">Ph\u00e1t hi\u1ec7n l\u1ed7 h\u1ed5ng m\u00e3 ngu\u1ed3n b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng x\u1eed l\u00fd ng\u00f4n ng\u1eef Nature v\u00e0 m\u1ea1ng \u0111\u1ed3 th\u1ecb s\u00e2u<\/li>\n<\/ul>\n<\/li>\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"TSMC th\u1eeba nh\u1eadn l\u1ed7 h\u1ed5ng trong chu\u1ed7i cung \u1ee9ng chip AI\">TSMC th\u1eeba nh\u1eadn l\u1ed7 h\u1ed5ng trong chu\u1ed7i cung \u1ee9ng chip AI<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<article id=\"content\" class=\"content gradient\"><img decoding=\"async\" src=\"https:\/\/dulieu.antoanthongtin.gov.vn\/tapchiantoanthongtin\/3ec28a69-6be5-426e-af49-035a53047bdf\/379-3792420_webmin-logo-png-transparent-png.png\" \/><\/p>\n<p><a href=\"https:\/\/antoanthongtin.vn\/tin\/sonicwall-canh-bao-ve-hai-lo-hong-vpn-bi-khai-thac-trong-cac-cuoc-tan-cong\">L\u1ed7 h\u1ed5ng<\/a>\u00a0xu\u1ea5t ph\u00e1t t\u1eeb vi\u1ec7c x\u1eed l\u00fd kh\u00f4ng \u0111\u00fang c\u00e1c chu\u1ed7i k\u00fd t\u1ef1 \u0111i\u1ec1u khi\u1ec3n CRLF (Carriage Return Line Feed) trong c\u00e1c y\u00eau c\u1ea7u CGI c\u1ee7a Webmin. Khi m\u1ed9t ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 x\u00e1c th\u1ef1c g\u1eedi y\u00eau c\u1ea7u \u0111\u1eb7c bi\u1ec7t, h\u1ecd c\u00f3 th\u1ec3 ch\u00e8n m\u00e3 \u0111\u1ed9c \u0111\u1ec3 thao t\u00fang ph\u1ea3n h\u1ed3i c\u1ee7a m\u00e1y ch\u1ee7 Webmin, t\u1eeb \u0111\u00f3 th\u1ef1c thi c\u00e1c l\u1ec7nh t\u00f9y \u00fd v\u1edbi \u0111\u1eb7c quy\u1ec1n root.<\/p>\n<p>\u0110i\u1ec1u \u0111\u00e1ng lo ng\u1ea1i l\u00e0 vi\u1ec7c khai th\u00e1c l\u1ed7 h\u1ed5ng kh\u00f4ng y\u00eau c\u1ea7u b\u1ea5t k\u1ef3 \u0111\u1eb7c quy\u1ec1n \u0111\u1eb7c bi\u1ec7t n\u00e0o ngo\u00e0i quy\u1ec1n \u0111\u0103ng nh\u1eadp b\u00ecnh th\u01b0\u1eddng v\u00e0o Webmin, \u0111i\u1ec1u m\u00e0 nhi\u1ec1u qu\u1ea3n tr\u1ecb vi\u00ean th\u01b0\u1eddng cho ph\u00e9p trong m\u1ea1ng n\u1ed9i b\u1ed9. Webmin, v\u1edbi h\u01a1n 1 tri\u1ec7u l\u01b0\u1ee3t c\u00e0i \u0111\u1eb7t h\u00e0ng n\u0103m, l\u00e0 m\u1ee5c ti\u00eau c\u00f3 gi\u00e1 tr\u1ecb cao \u0111\u1ed1i v\u1edbi nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng mu\u1ed1n x\u00e2m nh\u1eadp v\u00e0o m\u1ea1ng doanh nghi\u1ec7p, th\u00f4ng qua vi\u1ec7c khai t\u00e1c l\u1ed7 h\u1ed5ng n\u00e0y c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn c\u00e1c m\u1ed1i nguy hi\u1ec3m ti\u1ec1m t\u00e0ng sau:<\/p>\n<p>&#8211; To\u00e0n quy\u1ec1n ki\u1ec3m so\u00e1t h\u1ec7 th\u1ed1ng m\u00e1y ch\u1ee7.<\/p>\n<p>&#8211; C\u00e0i \u0111\u1eb7t\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/cyfirma-canh-bao-phan-mem-doc-hai-gia-mao-ung-dung-tai-chinh\">ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i<\/a>\u00a0ho\u1eb7c c\u1eeda h\u1eadu (backdoor).<\/p>\n<p>&#8211; \u0110\u00e1nh c\u1eafp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m.<\/p>\n<p>&#8211; L\u00e0m gi\u00e1n \u0111o\u1ea1n ho\u1eb7c t\u00ea li\u1ec7t h\u1ec7 th\u1ed1ng, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c d\u1ecbch v\u1ee5 \u0111ang v\u1eadn h\u00e0nh.<\/p>\n<p>C\u00e1c chuy\u00ean gia c\u1ea3nh b\u00e1o r\u1eb1ng l\u1ed7 h\u1ed5ng n\u00e0y c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau t\u1ea5n c\u00f4ng quy m\u00f4 l\u1edbn trong th\u1eddi gian t\u1edbi khi th\u00f4ng tin khai th\u00e1c \u0111\u01b0\u1ee3c ph\u1ed5 bi\u1ebfn r\u1ed9ng r\u00e3i. C\u00e1c chuy\u00ean gia c\u0169ng cho bi\u1ebft r\u0103ng, l\u1ed7 h\u1ed5ng n\u00e0y s\u1ebd \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn t\u1ea5t c\u1ea3 c\u00e1c b\u1ea3n c\u00e0i \u0111\u1eb7t Webmin tr\u01b0\u1edbc phi\u00ean b\u1ea3n 2.302 \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh v\u00e0o ng\u00e0y 10\/3\/2025. Ng\u01b0\u1eddi d\u00f9ng \u0111\u01b0\u1ee3c khuy\u1ebfn c\u00e1o c\u1eadp nh\u1eadt ngay \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o an to\u00e0n cho h\u1ec7 th\u1ed1ng.<\/p>\n<p>Webmin tr\u01b0\u1edbc \u0111\u00e2y \u0111\u00e3 t\u1eebng g\u1eb7p ph\u1ea3i c\u00e1c v\u1ea5n \u0111\u1ec1 b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng, bao g\u1ed3m l\u1ed7 h\u1ed5ng n\u00e2ng c\u1ea5p \u0111\u1eb7c quy\u1ec1n v\u00e0o n\u0103m 2024 (CVE-2024-12828) v\u00e0 s\u1ef1 c\u1ed1 backdoor v\u00e0o n\u0103m 2021. C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt nh\u1ea5n m\u1ea1nh r\u1eb1ng c\u00e1c l\u1ed7 h\u1ed5ng CRLF injection th\u01b0\u1eddng xu\u1ea5t ph\u00e1t t\u1eeb vi\u1ec7c x\u00e1c th\u1ef1c \u0111\u1ea7u v\u00e0o kh\u00f4ng \u0111\u1ea7y \u0111\u1ee7, \u0111i\u1ec1u n\u00e0y cho th\u1ea5y s\u1ef1 c\u1ea7n thi\u1ebft c\u1ee7a vi\u1ec7c ki\u1ec3m tra m\u00e3 nghi\u00eam ng\u1eb7t trong c\u00e1c\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/fortinet-mo-rong-nen-tang-bao-mat-ot-huong-den-viec-tang-cuong-bao-ve-co-so-ha-tang-quan-trong\">c\u00f4ng c\u1ee5 h\u1ea1 t\u1ea7ng quan tr\u1ecdng<\/a>.<\/p>\n<p>T\u00ednh \u0111\u1ebfn ng\u00e0y 05\/5\/2025, ch\u01b0a c\u00f3 b\u00e1o c\u00e1o v\u1ec1 vi\u1ec7c khai th\u00e1c l\u1ed7 h\u1ed5ng n\u00e0y tr\u00ean di\u1ec7n r\u1ed9ng, nh\u01b0ng th\u1eddi gian c\u00f4ng b\u1ed1 c\u00f4ng khai (t\u1eeb ng\u00e0y 28\/2\/2025 &#8211; 01\/5\/2025) cho th\u1ea5y k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 s\u1edbm t\u1eadn d\u1ee5ng \u0111i\u1ec3m y\u1ebfu n\u00e0y.<\/p>\n<p>L\u1ed7 h\u1ed5ng CVE-2025-2774 trong Webmin l\u00e0 m\u1ed9t m\u1ed1i \u0111e d\u1ecda nghi\u00eam tr\u1ecdng \u0111\u1ed1i v\u1edbi an to\u00e0n h\u1ec7 th\u1ed1ng. Vi\u1ec7c khai th\u00e1c l\u1ed7 h\u1ed5ng n\u00e0y c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn h\u1eadu qu\u1ea3 nghi\u00eam tr\u1ecdng. Do \u0111\u00f3, c\u00e1c qu\u1ea3n tr\u1ecb vi\u00ean h\u1ec7 th\u1ed1ng c\u1ea7n h\u00e0nh \u0111\u1ed9ng k\u1ecbp th\u1eddi \u0111\u1ec3 c\u1eadp nh\u1eadt ph\u1ea7n m\u1ec1m v\u00e0 \u00e1p d\u1ee5ng c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt c\u1ea7n thi\u1ebft nh\u1eb1m b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng kh\u1ecfi c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ti\u1ec1m \u1ea9n. N\u1ebfu c\u1ea7n h\u1ed7 tr\u1ee3 th\u00eam v\u1ec1 vi\u1ec7c ki\u1ec3m tra h\u1ec7 th\u1ed1ng ho\u1eb7c tri\u1ec3n khai c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt, h\u00e3y li\u00ean h\u1ec7 v\u1edbi b\u1ed9 ph\u1eadn an ninh m\u1ea1ng c\u1ee7a c\u00e1c t\u1ed5 ch\u1ee9c ho\u1eb7c chuy\u00ean gia b\u1ea3o m\u1eadt \u0111\u1ec3 \u0111\u01b0\u1ee3c t\u01b0 v\u1ea5n chi ti\u1ebft.<\/p>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>M\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nguy hi\u1ec3m v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong Webmin \u2013 c\u00f4ng c\u1ee5 qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng t\u1eeb xa ph\u1ed5 bi\u1ebfn tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 Linux\/Unix cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 leo thang \u0111\u1eb7c quy\u1ec1n v\u00e0 th\u1ef1c thi m\u00e3 t\u1eeb xa n\u1ebfu khai th\u00e1c th\u00e0nh c\u00f4ng. L\u1ed7 h\u1ed5ng n\u00e0y \u0111\u01b0\u1ee3c [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":46271,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[24,35],"tags":[],"class_list":["post-46270","post","type-post","status-publish","format-standard","has-post-thumbnail","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=46270"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46270\/revisions"}],"predecessor-version":[{"id":46272,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46270\/revisions\/46272"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/46271"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=46270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=46270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=46270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}