CVE-2020-35847: 
NixOS vulnerability analysis and mitigation

Agentejo Cockpit before version 0.11.2 contains a NoSQL injection vulnerability in the Controller/Auth.php resetpassword function. The vulnerability was disclosed on December 29, 2020, and affects the password reset functionality of the content management system (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper input validation in the resetpassword function within the Controller/Auth.php file. When combined with CVE-2020-35846, it allows attackers to dump all users and their password reset tokens, potentially leading to unauthorized access (AttackerKB).

The vulnerability allows attackers to gain unauthorized access to user accounts through password reset token manipulation. When exploited in conjunction with CVE-2020-35846, it enables attackers to enumerate all system users and their associated password reset tokens, potentially leading to complete system compromise (NVD, AttackerKB).

The vulnerability is highly exploitable as it requires no authentication or user interaction. Public exploits are available that demonstrate the ability to chain this vulnerability with CVE-2020-35846 to achieve remote code execution. The exploit chain has been documented in multiple security advisories (Packet Storm).

The vulnerability has been patched in Cockpit version 0.11.2. Users are strongly advised to upgrade to this version or later. The fix includes improved input validation for the resetpassword function and removal of potentially dangerous callable functions (GitHub Commit).

The vulnerability has been actively tracked by security researchers and has been observed in exploitation attempts. The GreyNoise security platform has documented attempts to exploit this vulnerability in combination with related CVEs (GreyNoise).