org.yamcs:yamcs-core@5.12.5

Affected versions of this package are vulnerable to Missing Authorization via the IamApi endpoints responsible for role and privilege enumeration. An attacker can access sensitive security configuration data by sending authenticated requests to GET /api/roles, GET /api/roles/{name}, or GET /api/privileges without possessing the necessary privileges. This enables the attacker to retrieve the full list of system privileges and role definitions, which can facilitate targeted privilege escalation attacks.

Upgrade org.yamcs:yamcs-core to version 5.12.8, 5.13.2 or higher.

Affected versions of this package are vulnerable to Missing Authorization in the WebSocket subscription handlers for packets, algorithm-status, and mdb-changes. An attacker can access sensitive data by subscribing to these WebSocket topics without the privilege checks that are enforced in the REST API counterparts.

Upgrade org.yamcs:yamcs-core to version 5.12.8, 5.13.2 or higher.

Affected versions of this package are vulnerable to Missing Authorization in the API controllers responsible for handling IndexesApi, Cop1Api, and TimeApi operations. An attacker can extract sensitive telemetry metadata, disrupt satellite communication link protocols, and manipulate the global simulation time by sending crafted API requests as an authenticated user with no assigned privileges.

Upgrade org.yamcs:yamcs-core to version 5.12.8, 5.13.2 or higher.

Affected versions of this package are vulnerable to Arbitrary Code Injection in the executeSql process. An attacker can execute arbitrary code with the privileges of the server process by injecting malicious Java code into a column name, which is then compiled and executed by the unsandboxed Janino compiler. This is only exploitable if the attacker has the ControlArchiving system privilege.

Upgrade org.yamcs:yamcs-core to version 5.12.8, 5.13.2 or higher.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the templateArgs parameter in the createInstance process. An attacker can execute arbitrary commands on the host system by injecting malicious YAML content that results in the instantiation of a service capable of running system commands. This is only exploitable if the attacker has the CreateInstances privilege or if the server is configured without authentication (no security.yaml).

Upgrade org.yamcs:yamcs-core to version 5.12.8, 5.13.2 or higher.

Affected versions of this package are vulnerable to Missing Authorization through the exportPackets process. An attacker can access sensitive telemetry data by sending an API request without specifying any packet names, which bypasses intended privilege checks and streams all available packets to the user.

Upgrade org.yamcs:yamcs-core to version 5.12.8, 5.13.2 or higher.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') via the updateAlgorithm process. An attacker can execute arbitrary code on the server by supplying crafted JavaScript payloads that are evaluated without restriction.

Note:

This is only exploitable if the deployment is running in the default configuration without a security.yaml file, or if a user has been granted the ChangeMissionDatabase privilege.

Upgrade org.yamcs:yamcs-core to version 5.12.7 or higher.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamic evaluation of user-supplied algorithm code in the script evaluation engine. An attacker can execute arbitrary operating system commands by injecting malicious Jython code through the REST API when authenticated with the required privileges.

Note:

This is only exploitable if the attacker has the ChangeMissionDatabase privilege and the Jython engine is present in the classpath, and there is an existing algorithm with its language set to Python.

Upgrade org.yamcs:yamcs-core to version 5.12.7 or higher.

Affected versions of this package are vulnerable to Brute Force through the handleToken process. An attacker can gain unauthorized access to user accounts by performing unlimited authentication attempts without restriction.

Upgrade org.yamcs:yamcs-core to version 5.12.7 or higher.

Affected versions of this package are vulnerable to Arbitrary Code Injection in the JavaExprAlgorithmExecutionFactory process. An attacker can execute arbitrary code on the underlying operating system by injecting malicious Java expressions through the REST API when authenticated with the ChangeMissionDatabase privilege.

Note:

This is only exploitable if the attacker possesses valid credentials with the required privilege and can access a running instance with an active processor.

Upgrade org.yamcs:yamcs-core to version 5.12.7 or higher.

Affected versions of this package are vulnerable to Missing Authorization in the IAM API endpoints, including listUsers, getUser, listGroups, and getGroup. An attacker can retrieve sensitive user information, such as usernames, superuser status, and group memberships, by sending authenticated requests to these endpoints without possessing elevated privileges.

Upgrade org.yamcs:yamcs-core to version 5.12.7 or higher.

Affected versions of this package are vulnerable to LDAP Injection via the LdapAuthModule process. An attacker can gain unauthorized access to user accounts by injecting specially crafted input into the username parameter during LDAP authentication.

Note:

This is only exploitable if the deployment uses org.yamcs.security.LdapAuthModule in the etc/security.yaml configuration file.

Upgrade org.yamcs:yamcs-core to version 5.12.7 or higher.