Warning! Webmin has detected that the program linked to from an unknown URL, which appears to be outside the Webmin server

5 posts / 0 new
Last post
#1 Mon, 10/16/2017 - 02:24
adamjedgar

Warning! Webmin has detected that the program linked to from an unknown URL, which appears to be outside the Webmin server

Hi guys, I did some searching and found another thread that appeared to be the same problem...https://www.virtualmin.com/node/9584

In looking at my issue below, I experience this in the latest version of Internet explorer but not in google chrome.

Warning! Webmin has detected that the program https://server3.foo.com.au:10000/virtual-server/link.cgi/10.152.0.4/http://www.user.com.au/ was linked to from an unknown URL, which appears to be outside the Webmin server. This may be an attempt to trick your server into executing a dangerous command.
Make sure your browser is configured to send referrer information so that it can be verified by Webmin.
Alternately, you can configure Webmin to allow links from unknown referers by :
Login as root, and edit the /etc/webmin/config file.
Find the line referers_none=1 and change it to referers_none=0.
Save the file.
WARNING - this has the side effect of opening your system up to reflected XSS attacks and so is not recommended!!


Is it possible that this has something to do with the way in which some browsers complain about self signed ssl certificates? (ie if I was to setup a letsencrypt ssl on my parent server URL, would this problem be less likely to happen (or has that got nothing to do with it?)

Also, another piece of information that may or may not be useful in problem solving this...I have installed an Adobe Muse website on this virtual server. I do not have any dns pointing to the website and am accessing it using the virtualmin services preview website tab.

Website is configured as an ssl website when the virtual server was created.

Is it possible that because within adobe muse I have given the website a url http://foo.com.au, but am accessing it from an ip address behind a NAT (google cloud) combined with self signed ssl, Microsoft internet explorer is refusing to send any referrer information when also using the webmin/virtualmin preview website option?

If I was to add this website as a trusted referrer...what url am I entering exactly? (the website is only preview and doesn't have a dns assigned to the domain yet...so is being accessed via ip address)

EDIT...tried adding the www.foo.com.au URL it doesn't work disabling trusted referrer checking produces nothing more than a blank page in website preview (tried refreshing it a few times...no luck)

Mon, 10/16/2017 - 15:22
Joe
Joe's picture

I haven't seen that behavior, but it comes from the client not sending a referer that Webmin recognizes (this is a mild form of XSS/CSRF protection, though there are other defenses against that in Webmin as well).

The referer that it's actually using can be seen in, for example, Firefox developer tools (I'm sure it's in Chrome dev tools, too), just by looking in the Network tab, clicking on the GET request, and looking at the Headers for the request. On my systems it includes the name of the Webmin system. If you are hitting the Webmin system through a NAT, and thus the IP you're talking to is different than the one Webmin think it has, you'd find this check would fail. Proxies can cause this kind of error, too.

So, look at the referer actually being sent and see if you can convince your browser to use something that is recognized by Webmin as "itself" (by way of setting up a hosts file entry, or similar). But, I don't entirely understand all the ways this check can go awry.

--

Check out the forum guidelines!

Topic locked