Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.
Timeline
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- CVE published
- Record last updated
Affected versions
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported
- cockpit
Version range not reported