Listen to this Post
The vulnerability stems from a design flaw in the authentication model (authentication.rb), where the password change functionality erroneously accepts a valid session token in place of the user’s old password. The critical issue lies in the `OpenC3::AuthModel.set` function, which calls `OpenC3::AuthModel.verify_no_service` with the `no_password` parameter set to false. This configuration allowed `verify_no_service` to validate either a password or a session token. An attacker who possesses a hijacked valid session token (obtained, for example, via XSS or session fixation) can leverage this flaw. They can issue a password change request, submitting the stolen token as the `old_password` parameter in a web proxy like Burp Suite. The system incorrectly accepts this token, allowing the attacker to set a new password of their choice without ever knowing the original one. Notably, the victim’s session token is not revoked upon a password reset, meaning the attacker’s token remains valid. After the legitimate user attempts to regain control by changing their password, the attacker can again use their still-valid token to re-change the password, locking out the legitimate user and establishing permanent persistence. The patch rectifies this by replacing the boolean `no_password` parameter with a more explicit `mode` parameter (:password, :token, or :any) and updating the `set` function to call `verify_no_service` with `mode: :password` to ensure only the actual password authorizes a change.
DailyCVE Form
- Platform: `OpenC3 COSMOS`
– Version: `<6.10.5, <7.0.0-rc3` - Vulnerability: `Auth token reuse` - Severity: `High (8.1)` - Date: `2026-04-22` - Prediction: `Patch 2026-03`
Analytics under What Undercode Say:
Check if running a vulnerable version openc3 version | grep -E "[0-9]+.[0-9]+.[0-9]+" Inspect verification logic grep -n "verify_no_service" /openc3/lib/openc3/models/auth_model.rb
Exploit:
Attacker sends password change request with stolen token (Burp/curl) curl -X POST https://openc3-cosmos.com/auth/password \ -H "Authorization: Bearer STOLEN_TOKEN" \ -d "old_password=STOLEN_TOKEN&new_password=attacker_pw"
Protection from this CVE
1. Upgrade to `>=6.10.5` or `>=7.0.0-rc3`.
2. Enable session invalidation on password changes.
3. Implement strict authentication mode enforcement.
Impact:
- Persistent attacker control over compromised accounts.
- Permanent denial of service to legitimate users.
- Enables lateral movement and data exfiltration in breached environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
