CVE-2020-35131: 
NixOS vulnerability analysis and mitigation

Cockpit before version 0.6.1 contains a Remote Code Execution vulnerability (CVE-2020-35131) that was disclosed on January 8, 2021. The vulnerability allows attackers to inject custom PHP code and achieve Remote Command Execution via the registerCriteriaFunction in lib/MongoLite/Database.php. This can be exploited by sending specially crafted JSON data to the /auth/check or /auth/requestreset URI (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue stems from insufficient input validation in the MongoLite Database component, specifically in the registerCriteriaFunction functionality. This allows attackers to inject and execute arbitrary PHP code through specially crafted JSON payloads sent to authentication endpoints (NVD).

Successful exploitation of this vulnerability allows attackers to execute arbitrary code on the affected server with the privileges of the web application. This could lead to complete system compromise, allowing attackers to access, modify, or delete sensitive data, and potentially gain full control of the affected system (Exploit DB).

The vulnerability is actively exploitable and proof-of-concept code is publicly available. The exploit can be triggered through the authentication endpoints (/auth/check and /auth/requestreset) by sending specially crafted JSON payloads. No authentication is required to exploit this vulnerability, making it particularly dangerous (Exploit DB).

The vulnerability has been fixed in Cockpit version 0.6.1. Users are strongly advised to upgrade to this version or later to mitigate the risk. No alternative workarounds have been published (Github Release).