openc3

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser

Summary

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory.

Details

In function save_tool_config() (local_mode.rb) responsible for saving user-supplied tool configuration, the desired saving directory is not sufficiently enforced, instead allowing writes inside entire OPENC3_LOCAL_MODE_PATH.

PoC

1. Navigate to any tool that enables “Save Configuration” option in left-hand drop-down menu (here Limits Monitor as an example)
2. Save a new config with path traversal name using “../” sequences to escape desired directory (up to 3 levels high)
3. Observe new files created in /plugins directory by inspecting docker container directly (openc3-COSMOS-cmd-tlm-api) or using Bucket Explorer (plugin_default)

Impact

Modifying the data of other plugins

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

1. Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
2. Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
3. Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

Vulnerability Type: Execution with Unnecessary Privileges Attack type: Authenticated remote Impact: Data disclosure/manipulation, privilege escalation Affected components: The following docker images: • Openc3inc/openc3-COSMOS-script-runner-api

The Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network.

Figure 1: Environment variables, including Redis credentials, found in the Script Runner container A Ruby script is used to expose the Redis username, password, hostname, and port. These credentials might also be found from the source code or through a brute-force attack.

Figure 2: A Python script is used to add data to Redis and retrieve the new data A Python script is then used to create a new entry in the Redis database called openc3__settings_hacked with a key of store_url and a value of http://hacked.com.

Figure 3: The new data found in the Redis database The new entry was successfully added to the Redis database, as is confirmed by using redis-cli. The following example shows how an attacker might change the plugin store URL file that is stored in the config bucket.

Figure 4: Uploading file to change the plugin store URL setting

Figure 5: The URL file was successfully changed

Steps To Reproduce

1. Run the following Ruby code to find the Redis credentials:

puts `env | grep redis`

3. Add the following Python script with the credentials to create a new entry and read it

import redis
import json
import time

r = redis.Redis(
    host = 'openc3-redis',
    port = 6379,
    username = 'openc3', 
    password = 'openc3password',  
    decode_responses=True
)

# Save a setting
setting_data = {
    'name': 'store_url',
    'data': 'http://hacked.com',
    'updated_at': time.time_ns()
}
r.hset('openc3__settings_hacked','store_url',json.dumps(setting_data))
print(r.hget('openc3__settings_hacked','store_url'))

Recommendations

• Limit the permissions of the script runner API to prevent lower level users from performing administrative actions

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get_tlm_values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get_tlm_values endpoint However, sending a specially crafted request within the start_time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get_tlm_values endpoint.
2. Add the start_time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Summary

The Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when sending a command. This creates a self-XSS risk because an attacker can trigger their own script execution in the victim’s session, if allowed to influence the array parameter input, for example via phishing. If successful, an attacker may read or modify data in the authenticated browser context, including session tokens in local storage.

Details

The unsafe eval() usage on user-supplied ARRAY parameters happens in convertToValue method in CommandSender.vue

PoC

1. Using a drop-down form, choose any command that supports ARRAY parameters,
2. Inside square brackets “[…]” place a JavaScript code to be executed
3. Send command to CmdTlmServer using dedicated “Send” button
4. Observe JavaScript code being executed in the current browser session context

Below example uses INST ARYCMD to execute simple JavaScript code snippet alert(“XSS”).

Impact

Local JavaScript execution in the user's browser