Cockpit System Logs UI Command Injection

This repository is a compact proof-of-concept exploit for CVE-2026-4802 targeting Cockpit on Linux. It contains three files: a Python exploit script (poc.py), a Dockerfile that builds a reproducible vulnerable Cockpit environment, and a README describing setup and usage. The exploit is not part of a larger framework. The main exploit logic is in poc.py. It first authenticates to the target Cockpit instance using HTTP Basic authentication against /cockpit/login and extracts the returned session cookie. It then upgrades to the Cockpit websocket endpoint at /cockpit/socket using the cockpit1 subprotocol, sends an init message, and opens websocket channels with payload type stream. Through these channels it requests command spawning on the remote host. The vulnerability is exploited by constructing a shell command that mimics the vulnerable loadServiceFilters() behavior: a journalctl invocation with a malicious --since=$(...) argument. The injected payload is wrapped in command substitution so that when /bin/bash -ec evaluates the command line, attacker-controlled shell commands execute. The script supports three modes: check, which writes id output to /tmp/cockpit-rce-check and reads it back to confirm RCE; exec, which redirects arbitrary command output to /tmp/.cockpit-rce-out and retrieves it; and reverse, which sends a bash reverse shell using /dev/tcp/<lhost>/<lport>. The Dockerfile provisions a Fedora-based Cockpit instance, creates a low-privileged viewer:viewer account, enables Cockpit on port 9090, and weakens configuration for testing by allowing unencrypted access and all origins in /etc/cockpit/cockpit.conf. This indicates the repository’s purpose is to demonstrate and validate the vulnerability in a lab environment rather than provide stealthy or large-scale exploitation tooling. Overall capability: authenticated remote code execution against vulnerable Cockpit instances, with command output retrieval and optional reverse shell callback. The exploit requires valid credentials and a reachable Cockpit service with the vulnerable logs UI code path present.