Exploitation Summary
EIP tracks 3 public exploits for CVE-2020-35847.
PoCs published by w33vils, h00die, Nikita Petrov, including Metasploit module exploits/multi/http/cockpit_cms_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2020-35847 and CVE-2020-35848, targeting Cockpit CMS versions before 0.11.2. The exploit demonstrates NoSQL injection to enumerate users, extract password reset tokens, and reset passwords, leveraging the `/auth/resetpassword` and `/auth/newpassword` endpoints.
Description
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
Exploits (3)
This repository contains a functional Python exploit for CVE-2020-35847 and CVE-2020-35848, targeting Cockpit CMS versions before 0.11.2. The exploit demonstrates NoSQL injection to enumerate users, extract password reset tokens, and reset passwords, leveraging the `/auth/resetpassword` and `/auth/newpassword` endpoints.
This exploit demonstrates a NoSQL injection vulnerability in Cockpit CMS 0.11.1, allowing username enumeration and password reset token extraction via crafted JSON payloads. It leverages the `$func` operator to dump user data and reset tokens, then resets the target user's password.
This Metasploit module exploits CVE-2020-35847 and CVE-2020-35846 in Cockpit CMS, chaining NoSQL injection to extract user data and reset tokens, followed by command injection for RCE. It automates user enumeration, password reset, and payload execution without disk writes.
Nuclei Templates (1)
http.favicon.hash:688609340 || http.html:"cockpit"
icon_hash=688609340 || body="cockpit"
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H