CVE-2020-35131

Think of Cockpit like a front door that accepts requests. In vulnerable versions, the door can be tricked into accepting and running attacker-written PHP “instructions” instead of just normal data. That can let an attacker take control of your server, install malware, and disrupt your services.

This matters if you run Cockpit and it is exposed to the network, because the flaw does not require authentication or user interaction. The risk is specifically that an attacker can reach the vulnerable service over the network (the exact default exposure is not confirmed in the findings).

This is urgent because attackers can remotely execute code without logging in, which can lead to complete compromise. The fix is straightforward: upgrade Cockpit to 0.6.1, since vulnerable versions exist before that release.

1. Confirm exposure

   • Identify how Cockpit is deployed and whether it is reachable from the network (public internet or untrusted networks).
   • Determine your currently installed Cockpit version.

2. Determine if you’re affected

   • You are affected if your Cockpit version is earlier than 0.6.1.

3. Upgrade remediation (primary fix)

   • Upgrade Cockpit to 0.6.1 (or later).
   • After upgrade, validate that the Cockpit service starts normally and that typical authentication flows still work.

4. Temporary workaround if you cannot patch immediately

   • Restrict network access so Cockpit is not reachable from the public internet.
   • Allow access only from trusted internal IP ranges (e.g., your office/VPN) and block all other traffic at the firewall or reverse proxy.

5. Post-upgrade checks

   • Review logs for suspicious unauthenticated requests carrying crafted JSON payloads.
   • Pay special attention to auth-related endpoints (the flaw is described as triggered via /auth/check or /auth/requestreset).

6. What to monitor next

   • Continued probing for unauthenticated endpoints.
   • Any new unexpected processes, outbound connections, or changes to server files that could indicate compromise (particularly if suspicious requests were seen before upgrading).

CVE-2020-35131 affects Cockpit versions before 0.6.1 and is rated extremely severe in the provided details. The mechanism is code injection leading to remote code execution: an attacker injects custom PHP code via JSON input processed through registerCriteriaFunction in lib/MongoLite/Database.php. The findings state that no authentication or user interaction is required and that network access is involved. A public exploit is available, and the traffic-light verdict is RED, indicating urgent real-world risk. KEV listing was not provided, but patch availability is clear: fixed in 0.6.1. (No KEV due date was given in the provided findings.)