NoSQL Injection in Cockpit CMS /auth/check Endpoint

This repository contains a single Metasploit module (modules/exploits/multi/http/cockpit_cms_rce.rb) targeting Cockpit CMS versions 0.10.0 to 0.11.1. The exploit chains two NoSQL injection vulnerabilities (CVE-2020-35846 and CVE-2020-35847) to enumerate users and extract password reset tokens. It then resets the password for a chosen user, logs in as that user, and leverages a command injection vulnerability to achieve remote code execution (RCE) on the target server. The module is weaponized, supporting arbitrary payloads via Metasploit's payload system, and operates over HTTP(S) endpoints exposed by the Cockpit CMS application. The code is written in Ruby and is structured as a typical Metasploit exploit module, with clear separation of enumeration, exploitation, and post-exploitation steps. The main attack vector is network-based, targeting web application endpoints. The module is operational and ready for use within the Metasploit framework.

This repository contains a proof-of-concept Python script (CVE-2020-35846.py) that exploits a NoSQL injection vulnerability (CVE-2020-35846) in Cockpit version 0.11.1. The script targets the Cockpit web application's authentication endpoint ('/auth/check') to leak valid usernames. It first retrieves a CSFR token from the login page, then sends a crafted JSON payload to the authentication endpoint, abusing NoSQL query logic to trigger a 'var_dump' function and leak usernames from the backend. The script is run from the command line, requiring the target host and optionally the Cockpit URL path and SSL flag. The repository also includes a README.md describing the exploit and its purpose. No additional payloads or post-exploitation actions are included; the exploit is limited to information disclosure (usernames) and serves as a proof-of-concept for the vulnerability.

This repository contains a Python exploit (exploit.py) targeting Cockpit CMS installations vulnerable to CVE-2020-35846, a NoSQL injection vulnerability. The exploit allows an attacker to enumerate users, reset their passwords, and ultimately deploy a PHP web shell for remote code execution. The main script, exploit.py, provides command-line options to either dump all user information or proceed with a full exploitation chain that results in a web shell being written to the server. The exploit interacts with several Cockpit CMS API endpoints, including /auth/requestreset, /auth/resetpassword, /auth/newpassword, and /media/api, to perform its actions. The payload deployed is a simple PHP web shell that executes system commands provided via the 'cmd' GET parameter. The repository also includes a README.md with usage instructions and a requirements.txt specifying the 'requests' library. The exploit is operational and provides a working attack chain from information disclosure to remote code execution.