GHSA-4jvx-93h3-f45h: Path Traversal and Arbitrary File Write in OpenC3 COSMOS

OpenC3 COSMOS configuration management system suffers from a path traversal vulnerability. The issue arises in the processing of configuration file names during save, load, and delete operations. Attackers leverage this flaw to write arbitrary files into the shared /plugins directory.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). By supplying a crafted configuration name containing directory traversal sequences, the application constructs a file path outside the intended directory boundary. The application implicitly trusts user input to perform underlying filesystem modifications.

The impact of this vulnerability encompasses arbitrary file writes, allowing attackers to overwrite existing plugin logic or configuration data. Because these files govern system execution and tool configurations, successful exploitation undermines system integrity and directly facilitates remote code execution if executable code is overwritten.

The root cause of GHSA-4jvx-93h3-f45h is the complete absence of input validation on the tool and name parameters within the ToolConfigModel component. The system blindly concatenates user-supplied strings to build file paths for disk operations. This structural design flaw inherently trusts external input during critical I/O processes.

When a user initiates the save_config method, the application passes the unsanitized parameters directly to LocalMode.save_tool_config. This method constructs the final destination path within the /plugins structure without neutralizing sequence characters like ../ or backslashes. The filesystem API subsequently accepts the path and resolves the traversal characters.

Because the underlying operating system resolves relative path components, a malicious payload traverses upwards from the intended base directory. The application effectively trusts the unsanitized input to define the final file destination, violating core secure design principles for filesystem operations.

The vulnerable implementation relies on direct parameter passing without sanitization. The ToolConfigModel.save_config method accepts the name parameter and forwards it directly to the file storage layer. The underlying Ruby code performs a basic hash set operation and invokes the local filesystem write without boundary checks.

def self.save_config(tool, name, data, local_mode: true, scope: $openc3_scope)
  Store.hset("#{scope}__config__#{tool}", name, data)
  # VULNERABLE: 'name' is passed directly to the filesystem method
  LocalMode.save_tool_config(scope, tool, name, data) if local_mode
end

The initial patch introduced a blacklist using the regular expression /[/\\]|\.\./ to block slashes and double-dot sequences. A subsequent commit replaced this with a strict allowlist approach to enforce defense-in-depth and prevent filter bypasses. This demonstrates a progression from a rudimentary mitigation to a robust security control.

# PATCHED: Strict allowlist validation
VALID_NAME_REGEX = /\A[A-Za-z0-9_\-. ]+\z/
def self.save_config(tool, name, data, local_mode: true, scope: $openc3_scope)
  raise InvalidNameError, "Invalid config name" unless name.match?(VALID_NAME_REGEX)
  Store.hset("#{scope}__config__#{tool}", name, data)
  LocalMode.save_tool_config(scope, tool, name, data) if local_mode
end

Exploitation requires an attacker to interact with the API endpoints responsible for saving or updating tool configurations. The attacker constructs a malicious HTTP request targeting these endpoints, replacing the legitimate configName parameter with a traversal payload. This interaction leverages standard functionality for a destructive purpose.

An attacker specifies a payload such as ../../../target_plugin/malicious_config. When the server processes this request, it appends the traversal string to the base plugin directory path. The application then writes the attacker-controlled data payload to the resolved location on the filesystem.

This methodology enables the attacker to overwrite the configuration or executable files of adjacent plugins. If the compromised plugin relies on the overwritten configuration for authentication or execution flow, the attacker hijacks its functionality entirely.

The primary impact is a severe breach of system integrity due to arbitrary file write capabilities. By escaping the intended /plugins/[scope]/tool_config/ directory, an attacker gains write access to the broader plugin filesystem structure. This structural compromise invalidates the application's internal isolation boundaries.

Overwriting configuration files of legitimate plugins allows an attacker to alter application behavior, bypass security controls, or inject malicious logic. Depending on the architecture, these overwritten files directly facilitate remote code execution if the system loads them as executable scripts or operational directives.

While the CVSS severity is classified as Moderate, the integrity impact is absolute within the context of the /plugins directory. The attack requires network access and likely administrative or tool-management privileges, limiting the initial threat but maximizing the post-exploitation damage potential.

Administrators must upgrade OpenC3 COSMOS to version 6.10.5 or 7.0.0-rc3 to fully remediate this vulnerability. These versions implement strict allowlist validation for all filesystem-related parameters in the configuration management component. Patching removes the execution path required for the directory traversal.

If immediate patching is unfeasible, administrators should restrict network access to the OpenC3 COSMOS management interfaces. Limiting access to trusted IP ranges and enforcing strict authentication reduces the exposure of the vulnerable API endpoints. Network-level controls serve as a temporary mitigation.

Security teams should audit the /plugins directory for unauthorized modifications. Searching for unexpected files or changes to core configuration files reveals indicators of compromise associated with path traversal exploitation attempts. Regular filesystem integrity monitoring provides an additional layer of defense.