OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.
The tsdb_lookup function in the cvt_model.rb file directly embeds user-supplied input into the SQL query without prior sanitization. An attacker can interrupt the original SQL query and inject arbitrary SQL commands. The vulnerability is remotely accessible to an authenticated user without requiring victim interaction, and exploitation does not require high privileges (PR:L).
An attacker can read, modify, and delete data stored in the COSMOS system database, and potentially affect data from monitored embedded systems. High impact on data confidentiality and integrity (C:H, I:H) with no impact on availability (A:N).
Update OpenC3 COSMOS to version 7.0.0-rc3 or later, where the vulnerability has been removed. Details available in vendor references: https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
OpenC3 COSMOS versions from 6.7.0 to (not including) 7.0.0-rc3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NOpenc3 Cosmos
APPOpenc37.0.06.7.0 – 7.0.0 (excl.)
Related vulnerabilities
OpenC3 COSMOS: ominięcie uprawnień API i dostęp do usług wewnętrznych sieci Docker
Path Traversal w endpoincie /script-api/scripts/ OpenC3 COSMOS
RCE w komponencie Plugin Management OpenC3 COSMOS poprzez spreparowany plik .txt
OpenC3 COSMOS — hardcoded credentials w koncie Service Account
OpenC3 COSMOS: Obejście uwierzytelnienia przez słabe wymagania haseł