Yamcs vulnerabilities

Yamcs prior to versions 5.12.8 and 5.13.2 has a vulnerability in LikeExpression.fillCode_getValueReturn where a LIKE pattern is not properly escaped and is inserted into Java source compiled by SimpleCompiler.cook. The pattern can originate from various API endpoints, and a quote in the pattern can inject Java that runs as the Yamcs server process.

Yamcs prior to versions 5.12.8 and 5.13.2 inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Successful exploitation executes commands as the Yamcs service account.

Yamcs before versions 5.12.8 and 5.13.2 allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source. Via the POST /api/archive/{instance}:executeSql endpoint, arbitrary Java code can be executed in the Yamcs server process, potentially exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

A vulnerability in Yamcs before version 5.12.7 allows an authenticated user with ChangeMissionDatabase privilege to achieve remote code execution by overriding Python algorithms in the Jython script engine. Lack of sandboxing enables importing and executing arbitrary Java classes, including java.lang.Runtime.

In Yamcs before version 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text was constructed without a ClassFilter, allowing a user with ChangeMissionDatabase privilege to override an algorithm and supply JavaScript that reaches arbitrary Java classes to execute arbitrary OS commands. In the default configuration with no security.yaml, the built-in guest user has superuser=true, making the issue reachable without authentication.

Yamcs before version 5.12.7 has a server-side code injection vulnerability in the algorithm evaluation engine. An authenticated user with ChangeMissionDatabase privilege can override an existing algorithm via the REST API and inject Java code, leading to remote code execution on the host.

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.

Yamcs prior to 5.11.13 contains a vulnerability in StaticFileHandler.locateFile, which resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

Yamcs before version 5.9.4 reflects the attacker-controlled redirect_uri parameter from GET /auth/authorize into authorize.html without adequate HTML escaping. A crafted authorization URL can execute JavaScript when opened by a Yamcs user, allowing theft of authentication material and account compromise.

Yamcs before versions 5.12.8 and 5.13.2 omits SystemPrivilege.ControlAccess checks in IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings.

Yamcs before versions 5.12.8 and 5.13.2 fails to enforce privileges required by equivalent REST endpoints in WebSocket subscription handlers. Specifically, subscriptions to packets, algorithm status, and mission database changes are available without required privileges, allowing low-privilege users to receive sensitive data.

Yamcs before versions 5.12.8 and 5.13.2 omits authorization checks in several API endpoints such as IndexesApi, Cop1Api, and TimeApi. An authenticated low-privilege user can read packet and event metadata, alter COP-1 link state, and manipulate simulation time.

In Yamcs prior to versions 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint failed to enforce object-level ReadPacket privileges when a request omitted specific packet names. An empty name list bypassed the WHERE pname IN filter, allowing a low-privileged or zero-privilege authenticated user to dump the entire raw telemetry packet archive.

In Yamcs before version 5.12.7, the authentication endpoint POST /auth/token lacks rate limiting, account lockout, or failed-attempt throttling. An unauthenticated remote attacker can perform unlimited password-guessing attempts against any user account.

In Yamcs prior to version 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup did not enforce the required SystemPrivilege.ControlAccess check. This allowed any authenticated user, even with low privileges, to enumerate all user accounts, including usernames, superuser status, and group memberships.

An LDAP injection vulnerability exists in the Yamcs mission control framework within the `LdapAuthModule` class. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping, allowing an attacker to manipulate LDAP queries.