CVE-2023-1313
📋 TL;DR
This vulnerability allows attackers to upload malicious files to the Cockpit CMS due to insufficient file type validation. It affects all users running Cockpit versions prior to 2.4.1, potentially leading to remote code execution or server compromise.
💻 Affected Systems
- Cockpit CMS
📦 What is this software?
Cockpit by Agentejo
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
File upload leading to web shell deployment, allowing attackers to execute arbitrary commands on the server.
If Mitigated
File upload attempts are blocked or logged, with no successful exploitation due to proper file validation.
🎯 Exploit Status
Exploitation requires file upload access but is straightforward once access is obtained. Public proof-of-concept exists in the bounty report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.1
Vendor Advisory: https://github.com/cockpit-hq/cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592
Restart Required: No
Instructions:
1. Update Cockpit to version 2.4.1 or later. 2. Use composer update cockpit-hq/cockpit or download from GitHub. 3. Verify the update by checking the version.
🔧 Temporary Workarounds
Disable File Uploads
allTemporarily disable file upload functionality in Cockpit configuration
Edit config/config.php and set 'upload' => false
Web Server File Restriction
linuxConfigure web server to block upload of dangerous file types
For Apache: Add 'Deny from all' to upload directory .htaccess
For Nginx: location ~ \.(php|phtml|sh)$ { deny all; }
🧯 If You Can't Patch
- Implement strict file type validation at the application level
- Isolate the Cockpit instance in a restricted network segment
🔍 How to Verify
Check if Vulnerable:
Check Cockpit version in admin panel or via composer show cockpit-hq/cockpitCheck Version:
composer show cockpit-hq/cockpit | grep versionsVerify Fix Applied:
Verify version is 2.4.1 or later and test file upload with dangerous extensions📡 Detection & Monitoring
Log Indicators:
- File upload attempts with .php, .phtml, .sh extensions
- Unusual file uploads to upload directories
- Web server error logs showing blocked uploads
Network Indicators:
- POST requests to upload endpoints with suspicious file types
- Traffic to unexpected files in upload directories
SIEM Query:
source="web.log" (method="POST" AND uri="*/upload*" AND (file_ext="php" OR file_ext="phtml" OR file_ext="sh"))