CVE-2020-35846: 
NixOS vulnerability analysis and mitigation

Agentejo Cockpit before version 0.11.2 contains a NoSQL injection vulnerability in the Controller/Auth.php check function. The vulnerability was disclosed on December 30, 2020, and affects all versions of Cockpit CMS up to (but not including) version 0.11.2 (NVD).

The vulnerability exists in the authentication mechanism where the Controller/Auth.php check function is susceptible to NoSQL injection. By sending specially crafted JSON data with malicious functions like var_dump in the user object, attackers can enumerate all usernames on the system. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating it can be exploited remotely without requiring privileges or user interaction (NVD, AttackerKB).

The successful exploitation of this vulnerability allows attackers to dump memory for the user object, effectively enabling the enumeration of all usernames on the system. When combined with other vulnerabilities, particularly CVE-2020-35847, it can lead to remote code execution (AttackerKB).

The vulnerability is highly exploitable as it requires no authentication and is vulnerable in default configurations. A Metasploit module (exploit/multi/http/cockpit_cms_rce) has been developed to exploit this vulnerability, making it easily weaponizable (Rapid7).

The vulnerability has been patched in Cockpit version 0.11.2. The fix includes removing $fn, $func, and $f as field filters and adding $where as an alternative in MongoLite, as well as implementing additional security checks for login functionality (Github). Users should upgrade to version 0.11.2 or later to mitigate this vulnerability.

The vulnerability has been actively monitored and tracked by security researchers and organizations. It has been observed being exploited in the wild, with security firms like GreyNoise detecting active exploitation attempts (GreyNoise).