Yamcs MDB JavaScript Algorithm Remote Code Execution Vulnerability and PoC

Vulnerability Overview Vulnerability Name: Remote Code Execution via Mission Database algorithm override Vulnerability Description: In Yamcs's default configuration (without ), the built-in guest user has privileges, allowing this vulnerability to be exploited without authentication. Attackers can execute arbitrary Java code via JavaScript CustomAlgorithm in the Mission Database (MDB), resulting in remote code execution. Impact Scope Affected Versions: - org.yamcs:yamcs-core (Maven) - < 5.13.0 - < 5.12.7 Impact: - Arbitrary code is executed with the privileges of the OS user running the Yamcs server, leading to server compromise and interruption of mission control. - For Yamcs deployments managing spacecraft operations, attackers can: - Forge or block telemetry, suppress alarms, and tamper with telemetry archives—interfering with or stealing mission control. - Read any files accessible to the Yamcs process (encryption keys, credentials, MDB source files, configurations). - Use the Yamcs server as a pivot to access other ground station systems (TSE instruments, neighboring Yamcs instances, internal services). - Install persistent backdoors via raw protocols. Who is Affected: - All Yamcs deployments running in default configuration (without ): Any unauthenticated remote network attacker can access the HTTP API port (default 8090). - Yamcs deployments with security enabled: Any user granted the system privilege. This privilege is typically assigned to MDB engineers and operators editing calibrators or thresholds; this vulnerability converts this privilege into arbitrary code execution on the server. Remediation Fixed Versions: - 5.13.0 - 5.12.7 POC Code Details Vulnerable File: Vulnerability Path: - (yamcs-core/src/main/java/org/yamcs/http/api/MDBOverrideApi.java:145-189) - (yamcs-core/src/main/java/org/yamcs/algorithms/AlgorithmManager.java:529-559) - (yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java:102-117) - PoC: - Targets any reachable Yamcs deployment that has at least one JavaScript CustomAlgorithm in its MDB. - Example listener for attacker: Impact: - Arbitrary code is executed with the privileges of the OS user running the Yamcs server, leading to server compromise and interruption of mission control. - For Yamcs deployments managing spacecraft operations, attackers can: - Forge or block telemetry, suppress alarms, and tamper with telemetry archives—interfering with or stealing mission control. - Read any files accessible to the Yamcs process (encryption keys, credentials, MDB source files, configurations). - Use the Yamcs server as a pivot to access other ground station systems (TSE instruments, neighboring Yamcs instances, internal services). - Install persistent backdoors via raw protocols. Who is Affected: - All Yamcs deployments running in default configuration (without ): Any unauthenticated remote network attacker can access the HTTP API port (default 8090). - Yamcs deployments with security enabled: Any user granted the system privilege. This privilege is typically assigned to MDB engineers and operators editing calibrators or thresholds; this vulnerability converts this privilege into arbitrary code execution on the server. Affected Versions All Yamcs versions from 4.7.3 to 5.12.6, as well as the current master version, are affected (133 release tags from 2018-11-22 to present). Fixed Versions 5.13.0 5.12.7 Additional Information CVSS v3 Base Metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2024-45542 Credits: 20CEB1 Weaknesses: - CWE-94 - CWE-95 - CWE-470 Publication Date: 2024-05-21 Reporter: 20CEB1 Summary This vulnerability allows attackers to execute arbitrary Java code via JavaScript CustomAlgorithm in the Mission Database, resulting in remote code execution. Affected versions are org.yamcs:yamcs-core < 5.13.0 and < 5.12.7. The remediation is to upgrade to version 5.13.0 or 5.12.7.

Goal Reached Thanks to every supporter — we hit 100%!

Yamcs MDB JavaScript Algorithm Remote Code Execution Vulnerability and PoC

More from this source