org.yamcs:yamcs-core 5.13.0

Direct Vulnerabilities

Known vulnerabilities in the org.yamcs:yamcs-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Arbitrary Code Injection Affected versions of this package are vulnerable to Arbitrary Code Injection via the `LikeExpression` process. An attacker can execute arbitrary operating system commands by supplying a crafted pattern containing unescaped characters that are injected into dynamically generated Java code at runtime. This allows code execution with the privileges of the application process through endpoints that compile user input into Java source without proper escaping. How to fix Arbitrary Code Injection? Upgrade `org.yamcs:yamcs-core` to version 5.12.8, 5.13.2 or higher.	[,5.12.8)[5.13.0,5.13.2)
M Missing Authorization Affected versions of this package are vulnerable to Missing Authorization via the `IamApi` endpoints responsible for role and privilege enumeration. An attacker can access sensitive security configuration data by sending authenticated requests to `GET /api/roles`, `GET /api/roles/{name}`, or `GET /api/privileges` without possessing the necessary privileges. This enables the attacker to retrieve the full list of system privileges and role definitions, which can facilitate targeted privilege escalation attacks. How to fix Missing Authorization? Upgrade `org.yamcs:yamcs-core` to version 5.12.8, 5.13.2 or higher.	[,5.12.8)[5.13.0,5.13.2)
H Missing Authorization Affected versions of this package are vulnerable to Missing Authorization in the WebSocket subscription handlers for `packets`, `algorithm-status`, and `mdb-changes`. An attacker can access sensitive data by subscribing to these WebSocket topics without the privilege checks that are enforced in the REST API counterparts. How to fix Missing Authorization? Upgrade `org.yamcs:yamcs-core` to version 5.12.8, 5.13.2 or higher.	[,5.12.8)[5.13.0,5.13.2)
H Missing Authorization Affected versions of this package are vulnerable to Missing Authorization in the API controllers responsible for handling `IndexesApi`, `Cop1Api`, and `TimeApi` operations. An attacker can extract sensitive telemetry metadata, disrupt satellite communication link protocols, and manipulate the global simulation time by sending crafted API requests as an authenticated user with no assigned privileges. How to fix Missing Authorization? Upgrade `org.yamcs:yamcs-core` to version 5.12.8, 5.13.2 or higher.	[,5.12.8)[5.13.0,5.13.2)
H Arbitrary Code Injection Affected versions of this package are vulnerable to Arbitrary Code Injection in the `executeSql` process. An attacker can execute arbitrary code with the privileges of the server process by injecting malicious Java code into a column name, which is then compiled and executed by the unsandboxed Janino compiler. This is only exploitable if the attacker has the `ControlArchiving` system privilege. How to fix Arbitrary Code Injection? Upgrade `org.yamcs:yamcs-core` to version 5.12.8, 5.13.2 or higher.	[,5.12.8)[5.13.0,5.13.2)
C Improper Neutralization of Special Elements Used in a Template Engine Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the `templateArgs` parameter in the `createInstance` process. An attacker can execute arbitrary commands on the host system by injecting malicious YAML content that results in the instantiation of a service capable of running system commands. This is only exploitable if the attacker has the `CreateInstances` privilege or if the server is configured without authentication (no `security.yaml`). How to fix Improper Neutralization of Special Elements Used in a Template Engine? Upgrade `org.yamcs:yamcs-core` to version 5.12.8, 5.13.2 or higher.	[,5.12.8)[5.13.0,5.13.2)
M Missing Authorization Affected versions of this package are vulnerable to Missing Authorization through the `exportPackets` process. An attacker can access sensitive telemetry data by sending an API request without specifying any packet names, which bypasses intended privilege checks and streams all available packets to the user. How to fix Missing Authorization? Upgrade `org.yamcs:yamcs-core` to version 5.12.8, 5.13.2 or higher.	[,5.12.8)[5.13.0,5.13.2)
M Improper Restriction of Rendered UI Layers or Frames Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames allowing an attacker to create a website that would encourage the user to perform specific actions. This type of vulnerability can have an exceptionally high impact on control systems, such as this package. How to fix Improper Restriction of Rendered UI Layers or Frames? There is no fixed version for `org.yamcs:yamcs-core`.	[0,)

Vulnerability

Vulnerable Version

Arbitrary Code Injection

Affected versions of this package are vulnerable to Arbitrary Code Injection via the LikeExpression process. An attacker can execute arbitrary operating system commands by supplying a crafted pattern containing unescaped characters that are injected into dynamically generated Java code at runtime. This allows code execution with the privileges of the application process through endpoints that compile user input into Java source without proper escaping.

How to fix Arbitrary Code Injection?