GHSA-9272-wg2r-7xmx: XSS
Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134.
Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted code into the URL, an attacker can execute arbitrary JavaScript code in a user’s browser. This URL may be sent to a user via a phishing email. <img width="940" height="294" alt="image" src="https://github.com/user-attachments/assets/d886d65c-9bb5-4599-ac11-55db83aafc0e" />
Steps to Reproduce: 1. Start a Yamcs instance. 2. Insert the following URL into the browser and press enter (change ‘myproject’ to the name of your instance): http://localhost:8090/ext/img%20src%3Dx%20onerror%3Dalert%281%29?c=myproject 3. You will receive an alert with the number ‘1’ in it.
Recommendations: 1. Use document.createElement instead of innerHTML in extension.component.ts. 2. Validate the extension against registered plugin IDs. 3. Enforce a strict custom-element-name regex before mounting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.yamcs:yamcs-coreto a version that resolves this vulnerability.Fixed in 5.12.8 - Upgrade
Upgrade
maven/org.yamcs:yamcs-coreto a version that resolves this vulnerability.Fixed in 5.13.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any user who opens a crafted /ext URL on a Yamcs instance is exposed. The described delivery method is a phishing email or other attacker-controlled link.
What does an attacker need to exploit it?
The attacker does not need authentication or special privileges. They need to convince a user to navigate to a specially crafted /ext URL for the target Yamcs instance.
Is user interaction required?
Yes. The user must open the malicious URL in their browser; the provided reproduction triggers JavaScript execution after the URL is entered.
What can be done if patching is not immediately possible?
The provided recommendations are to avoid using innerHTML in extension.component.ts, validate extensions against registered plugin IDs, and enforce a strict custom-element-name regular expression before mounting.