OpenC3 COSMOS Remote Code Execution Vulnerability via JSON-RPC API

A critical remote code execution vulnerability has been identified in OpenC3 COSMOS versions 5.0.0 prior to 6.10.1. This vulnerability is accessible through the JSON-RPC API. The issue arises when JSON-RPC requests utilize the string format of certain APIs, allowing attacker-controlled parameter text to be parsed into values using the String#convert_to_value method. For inputs resembling arrays, this method executes eval(). The vulnerability is exploited by sending a crafted JSON-RPC request that takes advantage of the string parsing and eval() execution, leading to unauthorized Ruby code execution on the server.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server where OpenC3 COSMOS is running.

Remediation

Users can upgrade to OpenC3 COSMOS version 6.10.2 to address this vulnerability.