published January 8, 2021
NVD has not assigned a CVSS score to this record. It sits in the 98.9th percentile for exploit probability.
🚨 An attacker can slip in custom PHP code like a delivery driver following the wrong instructions! This means Remote Command Execution is on the table with Cockpit before version 0.6.1! 🔥 Think of it as a restaurant that accepts any order without checking the menu, leading to surprise dishes that could ruin the meal — that’s what happens when insecure input is allowed here! If exploited, an attacker could run arbitrary commands on your server, altering or stealing data, or even taking full control of the system. The risk is real — your server could become a playground for mischief!
Think of it as a restaurant that accepts any order without checking the menu, leading to surprise dishes that could ruin the meal — that’s what happens when insecure input is allowed here! CVE-2020-35131 allows an attacker to inject custom PHP code through the registerCriteriaFunction method in lib/MongoLite/Database.php, specifically via JSON data sent to the /auth/check or /auth/requestreset URIs.
If exploited, an attacker could run arbitrary commands on your server, altering or stealing data, or even taking full control of the system. The risk is real — your server could become a playground for mischief! Upgrade Cockpit to version 0.6.1 or later to patch this vulnerability. Additionally, review your input validation processes to ensure that only safe data is accepted. Regularly audit your application for security holes! You totally got this! Just follow these steps and get back to maximum security! 🛡️