Is CVE-2024-43795 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-43795 being exploited in the wild.

How severe is CVE-2024-43795?

Low severity, with a CVSS score of 3.1, published 2 October 2024.

Which products and versions are affected?

@openc3/tool-common (npm) SEMVER:introduced=0,fixed=5.19.0; Openc3 Cosmos before 5.19.0; openc3 (PyPI) GIT:introduced=0,fixed=762d7e0e93bdc2f340b1e42acccedc78994a576e|ECOSYSTEM:introduced=0,fixed=5.19.0; openc3 (RubyGems) ECOSYSTEM:introduced=0,fixed=5.19.0.

Is there a fix for CVE-2024-43795?

Yes. @openc3/tool-common (npm): upgrade to 5.19.0 or later; openc3 (PyPI): upgrade to 5.19.0 or later; openc3 (RubyGems): upgrade to 5.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-43795 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-43795?

Check whether you run @openc3/tool-common (npm), Openc3 Cosmos, openc3 (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-43795: OpenC3 COSMOS cross-site scripting in login

CVE-2024-43795 · Severity: low · CVSS 3.1 · Published 2024-10-02

OpenC3 COSMOS is an open-source mission control and operations software platform used to manage complex systems and satellite operations. A reflected cross-site scripting vulnerability in the login functionality allows attackers to inject malicious scripts that execute in users' browsers, potentially leading to session hijacking, credential theft, or further compromise of the operations environment.

Technologies: Openc3 Cosmos, openc3 (PyPI), openc3 (RubyGems). Vendors: npm, Openc3, PyPI, RubyGems.

Quick answers

Is CVE-2024-43795 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-43795 being exploited in the wild.
How severe is CVE-2024-43795?: Low severity, with a CVSS score of 3.1, published 2 October 2024.
Which products and versions are affected?: @openc3/tool-common (npm) SEMVER:introduced=0,fixed=5.19.0; Openc3 Cosmos before 5.19.0; openc3 (PyPI) GIT:introduced=0,fixed=762d7e0e93bdc2f340b1e42acccedc78994a576e|ECOSYSTEM:introduced=0,fixed=5.19.0; openc3 (RubyGems) ECOSYSTEM:introduced=0,fixed=5.19.0.
Is there a fix for CVE-2024-43795?: Yes. @openc3/tool-common (npm): upgrade to 5.19.0 or later; openc3 (PyPI): upgrade to 5.19.0 or later; openc3 (RubyGems): upgrade to 5.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-43795 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-43795?: Check whether you run @openc3/tool-common (npm), Openc3 Cosmos, openc3 (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openc3/tool-common (npm): upgrade to 5.19.0 or later
```
npm install @openc3/tool-common@5.19.0
```
openc3 (PyPI): upgrade to 5.19.0 or later
```
pip install "openc3>=5.19.0"
```
openc3 (RubyGems): upgrade to 5.19.0 or later
```
bundle update openc3
```

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in OpenC3 COSMOS's login functionality, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability stems from insufficient input sanitization before rendering user-controllable data in the login page. The attack is network-accessible and requires user interaction (a victim must click a crafted link), with no authentication prerequisites. An attacker can craft a malicious URL containing JavaScript payload that executes in the victim's browser within the COSMOS application context, potentially enabling session hijacking, credential harvesting, or RCE through further exploitation. The fix is available in version 5.19.0 and later. This vulnerability affects the Open Source Edition only, not the Enterprise Edition.

Affected products

OpenC3 COSMOS before 5.19.0

Identifiers

CVE-2024-43795
GHSA-vfj8-5pj7-2f9g
PYSEC-2024-100

Timeline

2024-10-02: disclosed
2024-10-02: patched: Version 5.19.0 released

References

https://github.com/OpenC3/cosmos/security/advisories/GHSA-vfj8-5pj7-2f9g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.