Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue in the /auth/authorize endpoint. The redirect_uri parameter from the URL is reflected in the HTML response without proper escaping. The analysis of the patch commit 4d47d5cdcf5d92c2c5bbbc19feada422923332e3 reveals that the fix was to introduce an HTML escaping mechanism into the templating engine.
The call chain starts in org.yamcs.http.auth.AuthHandler.showLoginForm, which takes the request parameters, including the user-controlled redirect_uri, and passes them to the templating engine via ctx.render. The render call eventually invokes org.yamcs.templating.TemplateProcessor.process.
Before the patch, TemplateProcessor.process and the subsequent call to org.yamcs.templating.VarStatement.render would render the redirect_uri variable directly into the HTML without any escaping. This allowed an attacker to inject malicious scripts. The patch modifies the templating engine to support and apply an escape filter, which is then used in the authorize.html template to sanitize the output.
org.yamcs.http.auth.AuthHandler.showLoginFormyamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java
org.yamcs.templating.VarStatement.renderyamcs-core/src/main/java/org/yamcs/templating/VarStatement.java
org.yamcs.templating.TemplateProcessor.processyamcs-core/src/main/java/org/yamcs/templating/TemplateProcessor.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.yamcs:yamcs-core | maven | < 5.9.4 | 5.9.4 |