CVE-2020-35848 PoC — Agentejo Cockpit SQL注入漏洞

Source

Associated Vulnerability

Description

CVE-2020-35848 impacts Cockpit-CMS v1.7 due to unsafe handling of user inputs in authentication mechanisms, leading to remote code execution. This lab is built for CTF players and bug bounty learners to simulate real-world exploitation workflows including token extraction, password reset, and flag capture.

Readme

🧨 CVE‑2020‑35848 – Cockpit CMS < 0.11.2 NoSQL Injection (RCE) Lab
CVE‑2020‑35848 affects Agentejo Cockpit CMS versions before 0.11.2, introducing a critical NoSQL injection vulnerability in the /auth/newpassword endpoint. This flaw allows unauthenticated attackers to inject MongoDB operators into password-reset requests, enabling them to:

Enumerate valid usernames

Extract password-reset tokens

Reset passwords for arbitrary accounts

Chain into remote code execution via file uploads or custom admin actions 
Check Point Software
+11
NVD
+11
GitHub
+11
FortiGuard Labs
+2
Exploit Database
+2
GitHub
+2
Feedly
+1
GitHub
+1

📊 NVD Severity Metrics
CVSS v3.1 Score: 9.8 (Critical) — network exploit, no privileges or user interaction required, high impacts on confidentiality, integrity, availability 
NVD
+1
NVD
+1

CWE-89: NoSQL Injection (Improper neutralization of special elements—commands injected into database queries) 
Check Point Software
+10
NVD
+10
CVE Details
+10

🧪 Lab Features
Dockerized vulnerable instance of Cockpit CMS v0.11.1

Simulates user enumeration, token exfiltration, and password reset flows

Contains pre-built scripts (e.g., automated_exploit.sh) to demonstrate full exploitation path:

Username enumeration via injection in /auth/requestreset

Token extraction using /auth/newpassword

Password reset via /auth/resetpassword

Admin login & web flag retrieval

(Optional) RCE via admin-accessible upload or webhook endpoints

Challenges extend to manual privilege escalation to uncover system flags

File Snapshot

 [4.0K]  /data/pocs/52714e3081fdca9b1fdb665b652110676293d060
├── [1.4K]  build.sh
├── [1.0K]  LICENSE
└── [1.5K]  README.md

0 directories, 3 files

Remarks