| Package | Affected versions | Patched versions |
|---|---|---|
| org.yamcs:yamcs-core | ≥ 5.13.0, < 5.13.2< 5.12.8 | 5.13.25.12.8 |
| yamcs | ≥ 5.13.0, < 5.13.2< 5.12.8 | 5.13.25.12.8 |
The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges (ReadPacket) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.
In yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java, the exportPackets method processes requests to export raw packets from the tm (telemetry archive) table.
@Override
public void exportPackets(Context ctx, ExportPacketsRequest request, Observer<HttpBody> observer) {
String instance = InstancesApi.verifyInstance(request.getInstance());
Set<String> nameSet = new HashSet<>(request.getNameList());
ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet);
SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME);
// ... time filters ...
if (request.getNameCount() > 0) {
sqlb.whereColIn("pname", nameSet);
}
String sql = sqlb.toString();
// ...
The method attempts to verify privileges using ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet). However, if the request.getNameList() is empty (i.e., the attacker does not specify any packet names to filter by), nameSet is empty. The checkObjectPrivileges method loops over this empty set and successfully passes without throwing a ForbiddenException.
Since request.getNameCount() is 0, no WHERE pname IN (...) filter is added to the SQL query. The resulting sql query becomes a SELECT * FROM tm (with optional time filters).
Finally, the query is executed and the results are streamed back to the user:
StreamFactory.stream(instance, sql, sqlb.getQueryArguments(), new StreamSubscriber() {
@Override
public void onTuple(Stream stream, Tuple tuple) {
if (observer.isCancelled()) {
stream.close();
return;
}
byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);
HttpBody body = HttpBody.newBuilder()
.setData(ByteString.copyFrom(raw))
.build();
observer.next(body);
}
// ...
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeCrucially, unlike the streamPackets or exportPacket methods (which explicitly check ctx.user.hasObjectPrivilege for each packet retrieved before returning them), the onTuple handler in exportPackets blindly streams all retrieved packets to the user without any per-row authorization checks.
Thus, a user who possesses no ReadPacket privileges at all can easily bypass authorization and extract all telemetry data from the archive.
simulation example) with authentication enforced.ReadPacket privilege.name parameters:
curl -v -u low_priv_user:password "http://localhost:8090/api/archive/simulator:exportPackets" -o dumped_packets.raw
200 OK and streams all raw packets to the response, saving them to dumped_packets.raw.listPackets for an unauthorized packet), which correctly enforces authorization and rejects the request.Telemetry packets contain the core mission data, vehicle health status, and sensitive measurements (CCSDS Protocol data). This vulnerability completely breaks the access control model for telemetry data, allowing any authenticated user to exfiltrate all historical telemetry packets from the database. In an aerospace or mission-critical environment, this represents a severe data leak (Massive Information Disclosure) of proprietary or classified spacecraft data.
Ensure that exportPackets enforces the same per-row privilege checks as streamPackets.
Update the onTuple handler to check the user's privileges before emitting each packet:
@Override
public void onTuple(Stream stream, Tuple tuple) {
if (observer.isCancelled()) {
stream.close();
return;
}
// FIX: Retrieve packet name and check authorization
String pname = (String) tuple.getColumn(XtceTmRecorder.PNAME_COLUMN);
if (ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, pname)) {
byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);
HttpBody body = HttpBody.newBuilder()
.setData(ByteString.copyFrom(raw))
.build();
observer.next(body);
}
}
master branch.309218c651680f79df11a8d0f8628f7033f98a83Check version:
<img width="1157" height="489" alt="image" src="https://github.com/user-attachments/assets/58608222-b76f-4eb4-8e57-423523062992" />Check privilege of user:
<img width="1439" height="953" alt="image" src="https://github.com/user-attachments/assets/aa7e55f2-2460-4f24-8b6f-d461d2499a6f" />