Executive brief
OpenC3 COSMOS is a web-based satellite control and equipment testing platform. The application stores user passwords unencrypted in the browser's LocalStorage, making them vulnerable to theft if an attacker can execute JavaScript in the user's session (via cross-site scripting). This could allow attackers to harvest user credentials or hijack sessions, particularly dangerous given that the platform is used to control critical infrastructure like satellites.
Technical details
OpenC3 COSMOS stores user authentication passwords as cleartext in the web browser's LocalStorage, violating secure credential storage practices (CWE-312, CWE-522). When combined with XSS vulnerabilities (GHSL-2024-128), an attacker can inject malicious JavaScript into a victim's session to directly read `localStorage.openc3Token` or the password field, then exfiltrate these credentials. The attack requires the victim to access a malicious redirect parameter on the login page; no special privileges are needed beyond network access to the COSMOS instance. The vulnerability was fixed in version 5.19.0 by switching to session token-based authentication instead of storing passwords client-side.
Affected products
- OpenC3 COSMOS < 5.19.0
- OpenC3 openc3 (RubyGems) 5.0.6 through 5.18.0
- OpenC3 @openc3/tool-common (npm) < 5.19.0
- OpenC3 openc3 (PyPI) 0.1.0, 5.9.2b0 through 5.18.0
Timeline
- 2024-07-01: disclosed: Vulnerabilities reported via GitHub private vulnerability reporting
- 2024-10-02: patched: OpenC3 COSMOS v5.19.0 released with fixes
- 2024-10-02: advisory: GHSA-4xqv-47rm-37mm, CVE-2024-47529, PYSEC-2024-121 published