8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-wgx6-g857-jjf7

GHSA-wgx6-g857-jjf7: OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

Summary

The OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account.

Details

The design flaw in authentication model (authentication.rb) allows for interchangeable use of password and session tokens for user authentication As old tokens are not revoked upon password reset, an attacker who has obtained a valid session token can continue to authenticate and change the account’s password even after the victim resets it, thereby maintaining persistent control over the compromised account.

PoC

Attacker is logged in user account with hijacked valid session token, but not knowing the actual password
Legitimate user, as preventive action, changes his password (password123) using old password (password), that he knows, then establishes new session
Attacker issues another password change request (in web proxy like Burp) supplying his still valid token as old_password, changing it to attacker-password, from this point preventing any other legitimate users from accessing account <img width="912" height="479" alt="image" src="https://github.com/user-attachments/assets/d27b5980-0326-40f8-bb39-657d7b1c95a0" />

Impact

Persistence of an attacker who obtained valid session token and preventing legitimate users from account access

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-wgx6-g857-jjf7

GHSA-wgx6-g857-jjf7:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openc3	rubygems	< 6.10.5	6.10.5
openc3	rubygems	>= 7.0.0.pre.rc1, < 7.0.0-rc3	7.0.0-rc3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the password change functionality where a session token could be used in place of the user's old password. The core of the issue is in the OpenC3::AuthModel.set function, which is responsible for setting a new password. Before the patch, this function called OpenC3::AuthModel.verify_no_service with the no_password parameter set to false. This configuration allowed verify_no_service to validate either a password or a session token.

An attacker with a stolen session token could exploit this by calling the password change functionality and submitting the token as the old_password. The system would incorrectly accept the token, allowing the attacker to set a new password and gain persistent control over the account, locking out the legitimate user.

The patch rectifies this by replacing the boolean no_password parameter in verify_no_service with a more explicit mode parameter (:password, :token, or :any). Consequently, the set function was updated to call verify_no_service with mode: :password, ensuring that only the user's actual password can be used to authorize a password change, thus mitigating the vulnerability.

Vulnerable functions

OpenC3::AuthModel.set

openc3/lib/openc3/models/auth_model.rb

This function is responsible for changing the user's password. Before the patch, it used `verify_no_service` with `no_password: false`, which allowed an attacker to use a valid session token as the 'old_password' to change the account's password, leading to account takeover and persistence.

OpenC3::AuthModel.verify_no_service

openc3/lib/openc3/models/auth_model.rb

This function contained the flawed authentication logic. When called with `no_password: false` (as it was from the `set` function), it would validate either a password or a session token. This allowed the `set` function to be exploited. The patch introduces a `mode` parameter to distinguish between password and token verification explicitly.

AuthController.verify

openc3-cosmos-cmd-tlm-api/app/controllers/auth_controller.rb

This controller action for user authentication also used the flawed `verify_no_service` function in a way that could potentially allow a session token to be used where a password is expected, although the primary exploit path is through the password reset function. The patch changes this call to be explicit about expecting a password.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.