Attack Chain

1. Attacker authenticates to the target Cockpit CMS instance with a user account authorized to upload assets.
2. Attacker crafts a malicious .shtml file containing a JavaScript payload.
3. Attacker sends a POST request to the /assets/upload endpoint containing the crafted .shtml file.
4. The server-side logic fails to properly sanitize or block the .shtml extension despite its blacklisting logic for other dangerous file types.
5. The server saves the file to the assets directory and returns the file path to the attacker.
6. Attacker distributes the URL of the uploaded .shtml asset to a target user, often through social engineering or by placing it where users are likely to interact with it.
7. Target user visits the URL, causing the web browser to render the file and execute the malicious JavaScript payload in the user's session context.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of a victim's session, potentially leading to unauthorized data access, session token theft, or malicious actions within the CMS. The vulnerability affects all Cockpit CMS installations up to version 2.6.3.

Recommendation

Prioritize updating all instances of Cockpit CMS to a version beyond 2.6.3 that addresses the insecure file upload validation logic. As an immediate mitigation, implement strict ingress filtering at the Web Application Firewall (WAF) to block requests to /assets/upload that attempt to upload files with non-standard or dangerous extensions, specifically targeting .shtml and other server-side parsing extensions. Additionally, ensure that the server's MIME type handling and file upload policies are configured to enforce a whitelist-only approach for permitted file types, rather than relying solely on blacklists.