CVE-2024-2947

What it actually does

Deleting a sosreport with a crafted name via the Cockpit web interface triggers command injection, allowing execution of arbitrary commands and resulting in privilege escalation.

Why it matters to the business

Attackers can gain elevated system privileges, risking full server compromise, data exposure, and operational disruption; low EPSS and no KEV listing reduce immediate urgency but the 930-day exposure window warrants prompt attention.

How an attack unfolds

An attacker with local access and Cockpit web interface credentials crafts a sosreport filename containing shell metacharacters. When an administrator deletes the report through the interface, the unsanitized name is passed to a shell command, executing the attacker's payload for escalation.

How to fix it

Update Cockpit to a version that properly sanitizes sosreport names before shell operations; no fixed version is listed in the provided data.

How to confirm the fix worked

Review Cockpit source or changelog for input sanitization on sosreport deletion paths; test by attempting deletion of a report with a name containing benign command syntax and confirming no execution occurs.

Typical attack path

1. Obtain local user access and Cockpit web credentials
2. Create a sosreport using a filename embedding shell commands
3. Trigger deletion of the crafted sosreport via the web interface
4. Inject and execute commands to escalate privileges

How to detect it

Examine Cockpit and system logs for sosreport deletion operations involving filenames with shell metacharacters or unexpected command patterns; correlate with privilege changes or new process spawns immediately after deletion events.

What your security team should do

• Prioritize patching Cockpit instances to eliminate the command injection vector
• Audit logs for historical sosreport deletion events with anomalous filenames
• Restrict Cockpit web access to trusted networks and enforce least-privilege accounts