Skip to content

Commit 17e33a5

Browse files
jasnowjasnow
authored
GHSA/SYNC: 5 new openc3 advisories (#1050)
1 parent f0d5835 commit 17e33a5

5 files changed

Lines changed: 208 additions & 0 deletions

File tree

‎gems/openc3/CVE-2026-42084.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
gem: openc3
3+
cve: 2026-42084
4+
ghsa: wgx6-g857-jjf7
5+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7
6+
title: OpenC3 COSMOS - Hijacked session token can be used to reset
7+
password for persistence
8+
date: 2026-04-22
9+
description: |
10+
### Summary
11+
12+
The OpenC3 password change functionality allows a user to change their
13+
password without providing the old password, by accepting a valid
14+
session token instead. In assumed breach scenarios, this behaviour
15+
can be exploited by an attacker who has already obtained a valid
16+
session token, to gain persistence in hijacked account (including
17+
admin) and prevent legitimate users from accessing the account.
18+
19+
### Details
20+
21+
The design flaw in authentication model ([authentication.rb](https://github.com/OpenC3/cosmos/blob/397abec0d57972881a2e8dc10902d0dce9c27f42/openc3/lib/openc3/utilities/authentication.rb))
22+
allows for interchangeable use of password and session tokens for
23+
user authentication As old tokens are not revoked upon password
24+
reset, an attacker who has obtained a valid session token can
25+
continue to authenticate and change the account’s password even
26+
after the victim resets it, thereby maintaining persistent control
27+
over the compromised account.
28+
29+
### Impact
30+
31+
Persistence of an attacker who obtained valid session token and
32+
preventing legitimate users from account access.
33+
cvss_v3: 8.1
34+
patched_versions:
35+
- "~> 6.10.5"
36+
- ">= 7.0.0-rc3"
37+
related:
38+
url:
39+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42084
40+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7
41+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
42+
- https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
43+
- https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776
44+
- https://github.com/advisories/GHSA-wgx6-g857-jjf7

‎gems/openc3/CVE-2026-42085.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
gem: openc3
3+
cve: 2026-42085
4+
ghsa: 4jvx-93h3-f45h
5+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
6+
title: OpenC3 COSMOS allows arbitrary writes to plugins directory
7+
via path-traversed config filenames
8+
date: 2026-04-22
9+
description: |
10+
### Summary
11+
12+
OpenC3 COSMOS contains a design flaw in the `save_tool_config()`
13+
function that allows saving tool configuration files at arbitrary
14+
locations inside the shared `/plugins` directory tree by supplying
15+
crafted configuration filenames. Although the implementation
16+
sufficiently mitigates standard path traversal attacks, by
17+
canonicalizing filename to an absolute path, all plugins share this
18+
same root directory. That enables users to create arbitrary file
19+
structures and overwrite existing configuration files within the
20+
shared `/plugins` directory.
21+
22+
### Details
23+
24+
In function `save_tool_config()` ([local_mode.rb](https://github.com/OpenC3/cosmos/blob/397abec0d57972881a2e8dc10902d0dce9c27f42/openc3/lib/openc3/utilities/local_mode.rb#L452))
25+
responsible for saving user-supplied tool configuration, the desired
26+
saving directory is not sufficiently enforced, instead allowing
27+
writes inside entire `OPENC3_LOCAL_MODE_PATH`.
28+
29+
### Impact
30+
31+
Modifying the data of other plugins.
32+
cvss_v3: 4.3
33+
patched_versions:
34+
- "~> 6.10.5"
35+
- ">= 7.0.0-rc3"
36+
related:
37+
url:
38+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42085
39+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-4jvx-93h3-f45h
40+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
41+
- https://github.com/OpenC3/cosmos/releases/tag/v6.10.5
42+
- https://github.com/OpenC3/cosmos/commit/9957a9fa460c0c0cf5cdbf6a5931bbdd025246a5
43+
- https://github.com/OpenC3/cosmos/commit/e6efccbd148ba0e3361c5891027f2373aa140d42
44+
- https://github.com/advisories/GHSA-4jvx-93h3-f45h

‎gems/openc3/CVE-2026-42086.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
gem: openc3
3+
cve: 2026-42086
4+
ghsa: ffq5-qpvf-xq7x
5+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x
6+
title: OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
7+
date: 2026-04-22
8+
description: |
9+
### Summary
10+
11+
The Command Sender UI uses an unsafe `eval()` function on array-like
12+
command parameters, which allows a user-supplied payload to execute
13+
in the browser when sending a command. This creates a self-XSS risk
14+
because an attacker can trigger their own script execution in the
15+
victim’s session, if allowed to influence the array parameter input,
16+
for example via phishing. If successful, an attacker may read or
17+
modify data in the authenticated browser context, including session
18+
tokens in local storage.
19+
20+
### Details
21+
22+
The unsafe `eval()` usage on user-supplied ARRAY parameters happens
23+
in `convertToValue` method in [CommandSender.vue](https://github.com/OpenC3/cosmos/blob/main/openc3-cosmos-init/plugins/packages/openc3-cosmos-tool-cmdsender/src/tools/CommandSender/CommandSender.vue)
24+
25+
### Impact
26+
27+
Local JavaScript execution in the user's browser.
28+
cvss_v3: 4.6
29+
patched_versions:
30+
- ">= 7.0.0"
31+
related:
32+
url:
33+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42086
34+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-ffq5-qpvf-xq7x
35+
- https://github.com/advisories/GHSA-ffq5-qpvf-xq7x

‎gems/openc3/CVE-2026-42087.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
gem: openc3
3+
cve: 2026-42087
4+
ghsa: v529-vhwc-wfc5
5+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5
6+
title: OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database
7+
date: 2026-04-23
8+
description: |
9+
Vulnerability Type: CWE-89: Improper Neutralization of Special Elements
10+
used in an SQL Command ('SQL Injection')
11+
12+
Attack type: Authenticated remote
13+
14+
Impact: Telemetry data disclosure and deletion
15+
16+
Affected components: openc3-tsdb (QuestDB)
17+
18+
A SQL injection vulnerability exists in the Time-Series Database (TSDB)
19+
component of COSMOS. The `tsdb_lookup` function in the `cvt_model.rb`
20+
file directly places user-supplied input into a SQL query without
21+
sanitizing the input. As a result, a user can break out of the initial
22+
SQL statement and execute arbitrary SQL commands, including deleting data.
23+
24+
## Recommendations
25+
26+
* Sanitize all user-supplied input before executing it.
27+
* Use prepared statements with parameterized queries when
28+
executing SQL statements.
29+
cvss_v3: 9.6
30+
unaffected_versions:
31+
- "< 6.7.0"
32+
patched_versions:
33+
- ">= 7.0.0"
34+
related:
35+
url:
36+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42087
37+
- https://rubygems.org/gems/openc3/versions/7.0.0
38+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0
39+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5
40+
- https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415
41+
- https://github.com/advisories/GHSA-v529-vhwc-wfc5

‎gems/openc3/GHSA-2wvh-87g2-89hr.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
gem: openc3
3+
ghsa: 2wvh-87g2-89hr
4+
url: https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr
5+
title: OpenC3 COSMOS - Permissions Bypass Provides User Access to
6+
Unassigned Administrative Actions via Script Runner Tool
7+
date: 2026-04-23
8+
description: |
9+
Vulnerability Type: Execution with Unnecessary Privileges Attack
10+
type: Authenticated remote
11+
12+
Impact: Data disclosure/manipulation, privilege escalation
13+
14+
Affected components:
15+
16+
* The following docker images: Openc3inc/openc3-COSMOS-script-runner-api
17+
18+
The Script Runner widget allows users to execute Python and Ruby
19+
scripts directly from the openc3-COSMOS-script-runner-api container.
20+
Because all the docker containers share a network, users can execute
21+
specially crafted scripts to bypass the API permissions check and
22+
perform administrative actions, including reading and modifying data
23+
inside the Redis database, which can be used to read secrets and
24+
change COSMOS settings, as well as read and write to the buckets
25+
service, which holds configuration, log,and plugin files. These
26+
actions are normally only available from the Admin Console or with
27+
administrative privileges. Any user with permission to create and
28+
run scripts can connect to any service in the docker network.
29+
30+
## Recommendations
31+
32+
* Limit the permissions of the script runner API to prevent lower
33+
level users from performing administrative actions.
34+
cvss_v3: 9.6
35+
patched_versions:
36+
- ">= 7.0.0"
37+
related:
38+
url:
39+
- https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr
40+
- https://rubygems.org/gems/openc3/versions/7.0.0
41+
- https://github.com/OpenC3/cosmos/releases/tag/v7.0.0
42+
- https://www.linkedin.com/posts/vulert_critical-permissions-bypass-in-openc3-cosmos-activity-7453420840760774656-RMv1
43+
- https://www.miggo.io/vulnerability-database/cve/GHSA-2wvh-87g2-89hr
44+
- https://github.com/advisories/GHSA-2wvh-87g2-89hr

0 commit comments

Comments
 (0)