CVE-2020-35850: 
NixOS vulnerability analysis and mitigation

A Server-Side Request Forgery (SSRF) vulnerability was discovered in cockpit-project.org Cockpit version 234. The vulnerability was assigned CVE-2020-35850 and was disclosed on December 28, 2020. This issue specifically affects the login functionality of Cockpit and is unrelated to the Agentejo Cockpit product. The vulnerability was initially disputed by the vendor, who stated 'I don't think it is a big real-life issue' (NVD, MITRE).

The vulnerability exists in the login page functionality where an unauthenticated user can manipulate the 'Connect to' field to send requests to internal hosts. The issue allows attackers to detect open ports on the server or internal network, potentially bypassing firewall configurations. The vulnerability has a CVSS v3.1 Base Score of 6.5 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, GitHub Issue).

The vulnerability allows attackers to perform port scanning and detect open services on both the server hosting Cockpit and internal network hosts. This could enable attackers to bypass firewall rules and use the server as a gateway for scanning internal networks. The impact is particularly significant when the target has different firewall rules for localhost versus external connections (GitHub Research).

The vulnerability can be exploited by an unauthenticated attacker by manipulating the 'Connect to' field in the login panel's 'Other Options' section. The attacker can determine if ports are open based on the server's response timing and error messages. For example, when connecting to an open SSH port with incorrect credentials, the server returns a '401 Authentication Failed' response, while attempts to connect to closed ports result in immediate 'no-host' responses (GitHub Issue).