GHSA-ff27-5cfv-jh69: Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ground Stationto a version that resolves this vulnerability.Fixed in 0.8.20
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with the operator role can invoke the get-orbital-sources Socket.IO handler, also exposed as get-tle-sources. Administrator privileges are not required to read the stored credentials.
What information can be exposed?
The affected handlers can return plaintext usernames, passwords, and tokens that administrators configured for basic and token orbital sources.
Which deployments are affected?
Ground Station versions from 0.6.0 through versions before 0.8.20 are affected. The issue exists because the read handlers are not restricted to administrators, even though the corresponding write handlers are admin-only.