/
← Voltar ao feed
high

CVE-2026-4802: Cockpit command injection lets low-privilege authenticated users gain RCE via journal log filters; public PoC released

1 fonte(s) · 1 atualização(ões) · publicado 13/05/2026 16:45 · coletado há 2 dias

A command injection vulnerability, CVE-2026-4802, was disclosed in Cockpit, the web-based Linux administration tool from Red Hat. It was found by Hakai's Research team. Any authenticated user, including low-privilege accounts such as viewer, can inject OS commands through the system logs filter feature and obtain remote code execution on the server. Cockpit ships by default on several distributions (RHEL, Fedora, CentOS Stream, Ubuntu Server, Debian) and listens on port 9090. A public proof of concept with check, exec and reverse-shell modes has been published on Hakai's GitHub. The article does not report in-the-wild exploitation.

Detalhes técnicos

  • The user-controlled since parameter (from cockpit.location.options) is concatenated into --since= by build_cmd() in pkg/lib/journal.js (line 94) without sanitization.
  • loadServiceFilters() in pkg/systemd/logsJournal.jsx (line 200) builds a single string for cockpit.spawn(["/bin/bash", "-ec", cmd]). In pkg/systemd/logsHelpers.js (line 64), the display filter escapes only spaces, so $, backticks, parentheses and ; pass through intact. Bash then expands command substitution such as $(...).
  • Exploitation uses the authenticated WebSocket at /cockpit/socket (subprotocol cockpit1). The attacker sends init, then opens a stream channel whose spawn array contains /bin/bash -ec plus the injected command.
  • The demo payload --since=$(id>/tmp/cockpit-rce-check) returned uid=0(root), because the channel is opened with superuser: "try". A reverse shell was also obtained with a bash -i >& /dev/tcp/... payload.
  • The weakness maps to CWE-78 (OS command injection).

Remediação

  • Update Cockpit immediately to the latest version containing the fix.
  • If patching is not possible, restrict Cockpit access (port 9090) to trusted users and review which accounts have access.
  • The proper code fix is to pass arguments as an array to the process instead of a concatenated string passed to /bin/bash -ec, or to apply correct escaping.
  • References: Red Hat advisory and Bugzilla 2451155.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 13/05/2026 16:45 · coletado 19/10 18:03 primeiro registro

    CVE-2026-4802: Cockpit command injection lets low-privilege authenticated users gain RCE via journal log filters; public PoC released

    ler a análise desta fonte

    A command injection vulnerability, CVE-2026-4802, was disclosed in Cockpit, the web-based Linux administration tool from Red Hat. It was found by Hakai's Research team. Any authenticated user, including low-privilege accounts such as viewer, can inject OS commands through the system logs filter feature and obtain remote code execution on the server. Cockpit ships by default on several distributions (RHEL, Fedora, CentOS Stream, Ubuntu Server, Debian) and listens on port 9090. A public proof of concept with check, exec and reverse-shell modes has been published on Hakai's GitHub. The article does not report in-the-wild exploitation.

    Technical Details

    • The user-controlled since parameter (from cockpit.location.options) is concatenated into --since= by build_cmd() in pkg/lib/journal.js (line 94) without sanitization.
    • loadServiceFilters() in pkg/systemd/logsJournal.jsx (line 200) builds a single string for cockpit.spawn(["/bin/bash", "-ec", cmd]). In pkg/systemd/logsHelpers.js (line 64), the display filter escapes only spaces, so $, backticks, parentheses and ; pass through intact. Bash then expands command substitution such as $(...).
    • Exploitation uses the authenticated WebSocket at /cockpit/socket (subprotocol cockpit1). The attacker sends init, then opens a stream channel whose spawn array contains /bin/bash -ec plus the injected command.
    • The demo payload --since=$(id>/tmp/cockpit-rce-check) returned uid=0(root), because the channel is opened with superuser: "try". A reverse shell was also obtained with a bash -i >& /dev/tcp/... payload.
    • The weakness maps to CWE-78 (OS command injection).

    Remediation

    • Update Cockpit immediately to the latest version containing the fix.
    • If patching is not possible, restrict Cockpit access (port 9090) to trusted users and review which accounts have access.
    • The proper code fix is to pass arguments as an array to the process instead of a concatenated string passed to /bin/bash -ec, or to apply correct escaping.
    • References: Red Hat advisory and Bugzilla 2451155.