CVE-2024-2947

Executive Summary

CVE-2024-2947 is a command injection vulnerability discovered in the Cockpit web-based system administration tool. The flaw resides in the sosreport deletion functionality. By crafting a malicious filename for a sosreport, an authenticated attacker can inject arbitrary operating system commands when the report is deleted via the Cockpit web interface. This can lead to privilege escalation, as the Cockpit service typically runs with elevated privileges. The vulnerability affects Cockpit versions 270 and newer. No official patch has been released at the time of this analysis, and no public proof-of-concept code is available.

CVSS Breakdown & Threat Level

The CVSS score for this vulnerability has not been officially assigned. However, based on the nature of the flaw (command injection, privilege escalation), a high severity rating is expected. A hypothetical CVSS vector could be: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the Cockpit web interface's handling of sosreport deletion. When a user deletes a sosreport, the application constructs a command to remove the file from the filesystem. The filename is not properly sanitized before being passed to a shell command. An attacker with access to the Cockpit web interface can create a sosreport with a crafted name containing shell metacharacters (e.g., ;, |, $(), `). When the deletion operation is triggered, the injected commands are executed by the shell, allowing the attacker to execute arbitrary code with the privileges of the Cockpit process.

The core issue is the use of a shell command to delete files rather than using a safe API function that avoids shell interpretation. The vulnerable code likely uses a function like system() or popen() with a string that includes the filename without proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Using shell command with unsanitized filename
def delete_sosreport(filename):
    command = f"rm -f /var/lib/cockpit/sosreports/{filename}"
    os.system(command)

Patched Code (Conceptual):

# Patched: Using safe file deletion API
import os
def delete_sosreport(filename):
    safe_path = os.path.join("/var/lib/cockpit/sosreports/", filename)
    # Validate path is within expected directory
    if not os.path.realpath(safe_path).startswith("/var/lib/cockpit/sosreports/"):
        raise ValueError("Invalid path")
    os.remove(safe_path)

The patched version uses os.remove() which does not invoke a shell, and includes path validation to prevent directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the Cockpit web interface (authenticated session)
• Ability to create a sosreport (or any file) with a custom name

Exploitation Steps:

1. Log in to the Cockpit web interface.
2. Navigate to the sosreport section.
3. Create a new sosreport with a crafted filename containing command injection payload. For example: report;id>/tmp/pwned;sosreport
4. Trigger the deletion of this crafted sosreport.
5. The injected command (id>/tmp/pwned) will be executed, writing the output of the id command to /tmp/pwned.

Proof-of-Concept (Conceptual):

# This is a conceptual PoC; actual exploitation may vary
curl -X POST -u "user:password" \
  -d '{"filename":"test;echo pwned > /tmp/pwned;sosreport"}' \
  https://cockpit-server:9090/cockpit/api/sosreport/delete

Blue Team

Detection:

• Monitor for sosreport filenames containing shell metacharacters (;, |, &, $, `, (, ), <, >, \n, \r)
• Monitor process execution logs for unexpected commands spawned by the Cockpit process
• Monitor file creation in /tmp/ or other writable directories by the Cockpit process

Hunting:

• Search for Cockpit logs containing unusual filenames
• Review audit logs for execve syscalls from the Cockpit process

Indicators of Compromise (IOCs)

• File-based:

  • /tmp/pwned or similar files created by injected commands
  • sosreport files with names containing shell metacharacters in /var/lib/cockpit/sosreports/

• Process-based:

  • Unexpected child processes spawned by the Cockpit process (e.g., id, whoami, nc, bash)

• Network-based:

  • Outbound connections from the Cockpit server to attacker-controlled IPs (if reverse shell is injected)

• Log-based:

  • Cockpit audit logs showing deletion of files with suspicious names
  • System logs showing execution of commands like id, whoami, uname -a from the Cockpit process

Detection Engineering

YARA Rule

rule CVE_2024_2947_Cockpit_Command_Injection {
    meta:
        description = "Detects sosreport filenames with shell metacharacters indicative of CVE-2024-2947 exploitation"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "CVE-2024-2947"
        severity = "high"
    strings:
        $shell_meta1 = /[;|&$()<>`\n\r]/
        $sosreport_path = "/var/lib/cockpit/sosreports/"
    condition:
        $sosreport_path and any of ($shell_meta*)
}

Sigma Rule

title: Cockpit Command Injection via sosreport Deletion
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection attempts via crafted sosreport filenames in Cockpit
author: Valters IT
date: 2024/03/15
references:
    - CVE-2024-2947
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '/cockpit-ws'
        CommandLine|contains:
            - ';'
            - '|'
            - '&'
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in filenames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2947 Cockpit Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cockpit/api/sosreport/delete"; http_uri; pcre:"/(;|\||&|\$\(|`)/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to the Cockpit web interface to trusted networks only.
2. Implement strict input validation for sosreport filenames, rejecting any names containing shell metacharacters.
3. Monitor Cockpit logs for suspicious deletion activities.

Long-term Fix:

• Apply the official patch from the Cockpit project once released.
• Upgrade to a patched version of Cockpit.
• Implement a Web Application Firewall (WAF) rule to block requests with shell metacharacters in the filename parameter.

Workaround:

• Disable the sosreport deletion functionality if not required.
• Use a custom script to delete sosreports that sanitizes filenames before passing to the shell.

Valters IT