Command Injection in Cockpit CMS FFmpeg Integration

Cockpit CMS version 2.14.0 and prior contains a command injection vulnerability within its FFmpeg-based video processing integration. The vulnerability occurs because the application passes a user-supplied filename directly to Process::fromShellCommandline() before applying its slugify() sanitization logic.

An authenticated user possessing the assets/upload permission can exploit this by uploading a video file containing shell metacharacters (e.g., backticks, $(), or semicolons) within its filename. The underlying shell interprets these characters as command separators or subcommands, allowing the attacker to execute arbitrary commands with the privileges of the web-server user. This vulnerability represents a critical risk for deployments where untrusted users are granted file upload capabilities, as it provides a direct path to remote code execution (RCE) on the host server. Defenders should identify instances of Cockpit CMS and restrict access to the file upload functionality until the software can be patched.

Attack Chain

1. Attacker authenticates to the Cockpit CMS application using valid credentials with assets/upload permissions.
2. Attacker crafts a video file name containing shell-breaking metacharacters (e.g., test.mp4;id.mp4 or $(whoami).mp4).
3. Attacker initiates a file upload request through the Cockpit CMS dashboard or API for the asset management module.
4. The application receives the upload and invokes the FFmpeg integration component to process the video.
5. The integration logic fails to sanitize the filename before passing it to Process::fromShellCommandline().
6. The system shell parses the injected characters, treating the filename suffix as an independent command.
7. The OS executes the injected command with the UID of the web-server process (e.g., www-data or apache).
8. Final objective achieved: remote command execution enabling persistence, further lateral movement, or data exfiltration from the web server.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary system commands on the host server. This could lead to a full system compromise, unauthorized access to sensitive application data, or pivoting into the internal network. The vulnerability impacts any organization running Cockpit CMS version 2.14.0 or earlier.

Recommendation

• Upgrade Cockpit CMS to a version beyond 2.14.0 that implements input sanitization prior to process invocation.
• Review and restrict user accounts with assets/upload permissions to minimize the attack surface.
• Audit webserver error and access logs for requests containing shell metacharacters in filenames, specifically looking for unusual patterns in POST requests to asset upload endpoints.
• Deploy WAF rules to inspect and block file upload parameters containing characters like ;, `, $, or | when processed by web-based CMS upload controllers.