CVE-2020-10788
📋 TL;DR
openITCOCKPIT versions before 3.7.3 use a hardcoded API key (1fea123e07f730f76e661bced33a94152378611e) for WebSocket connections instead of generating random keys. This allows attackers to bypass authentication and gain unauthorized access to the monitoring system. All openITCOCKPIT installations before version 3.7.3 are affected.
💻 Affected Systems
- openITCOCKPIT
📦 What is this software?
Openitcockpit by It Novum
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, access sensitive monitoring data, modify configurations, and pivot to other systems in the network.
Likely Case
Unauthorized access to monitoring dashboards, viewing of sensitive system metrics and configurations, and potential privilege escalation within openITCOCKPIT.
If Mitigated
Limited impact with proper network segmentation and access controls, but still exposes monitoring data to unauthorized users.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to use the hardcoded API key in WebSocket requests. The key is publicly documented in the CVE description and commit history.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.3
Vendor Advisory: https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
Restart Required: Yes
Instructions:
1. Backup your current configuration and database. 2. Update to openITCOCKPIT version 3.7.3 or later. 3. Restart the openITCOCKPIT service. 4. Verify that WebSocket connections now use randomly generated API keys.
🔧 Temporary Workarounds
Disable WebSocket functionality
linuxTemporarily disable WebSocket connections until patching is possible
# Edit openITCOCKPIT configuration to disable WebSocket
# Location varies by installation, typically in /etc/openitcockpit/
Network access restrictions
linuxRestrict network access to openITCOCKPIT WebSocket ports (typically 8080, 8443)
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP
sudo iptables -A INPUT -p tcp --dport 8443 -j DROP
🧯 If You Can't Patch
- Isolate openITCOCKPIT system on a separate VLAN with strict access controls
- Implement network monitoring for WebSocket connections using the hardcoded API key
🔍 How to Verify
Check if Vulnerable:
Check if WebSocket connections accept the hardcoded API key 1fea123e07f730f76e661bced33a94152378611eCheck Version:
openitcockpit --versionVerify Fix Applied:
Verify that WebSocket connections now require a randomly generated API key and reject the hardcoded key📡 Detection & Monitoring
Log Indicators:
- WebSocket authentication failures using the hardcoded key
- Unauthorized WebSocket connection attempts
Network Indicators:
- WebSocket traffic containing the hardcoded API key in requests
- Unusual WebSocket connection patterns
SIEM Query:
websocket AND ("1fea123e07f730f76e661bced33a94152378611e" OR "api_key=1fea123e07f730f76e661bced33a94152378611e")🔗 References
- https://github.com/it-novum/openITCOCKPIT/commit/581cc9007bbfba84a2575729d5d903ab3a8f25ee
- https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
- https://github.com/it-novum/openITCOCKPIT/commit/581cc9007bbfba84a2575729d5d903ab3a8f25ee
- https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
