CyberRota Analysis
AI-GeneratedThe vulnerability affects the Yamcs mission control framework, specifically in versions prior to 5.12.7, where the Nashorn ScriptEngine allows users with the ChangeMissionDatabase privilege to execute arbitrary OS commands via JavaScript. This critical flaw can be exploited without authentication due to default configurations that grant superuser access to the built-in guest user. Organizations using Yamcs should prioritize upgrading to versions 5.12.7 or 5.13.0 to mitigate this severe security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
Related CVEs
Other vulnerabilities affecting the same vendor(s)