Bug 1916627 (CVE-2020-35131)

Summary:	CVE-2020-35131 cockpit: registerCriteriaFunction in lib/MongoLite/Database.php allows for a Remote Command Execution via custom php code injection
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dblechte, dfediuck, dperpeet, eedri, mgoldboi, michal.skrivanek, mmarusak, mpitt, pvolpe, sbonazzo, sherold, stefw, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in cockpit. An attacker is able to inject custom PHP code and achieve remote command execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-01-18 06:27:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1916630

Description Marian Rehak 2021-01-15 10:06:56 UTC

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.

Reference:

https://github.com/agentejo/cockpit/commits/next/lib/MongoLite/Database.php
https://github.com/agentejo/cockpit/releases/tag/0.6.1

Comment 1 Marian Rehak 2021-01-15 10:07:20 UTC

Created cockpit tracking bugs for this issue:

Affects: fedora-all [bug 1916628]

Comment 2 Martin Pitt 2021-01-15 10:41:12 UTC

*** Bug 1916628 has been marked as a duplicate of this bug. ***

Comment 3 Doran Moppert 2021-01-18 01:43:31 UTC

Statement:

This vulnerability applies to Cockpit CMS (https://getcockpit.com/), which is a different product than the Cockpit Project (https://cockpit-project.org/) used in Red Hat products.  The Cockpit Project is not affected by this vulnerability.

Comment 4 Product Security DevOps Team 2021-01-18 06:27:57 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-35131