Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in OpenC3 COSMOS allows an attacker to run arbitrary SQL commands by exploiting a weakness in how user input is handled. This means attackers could potentially delete data or compromise sensitive information within the system. Teams should pay attention because this issue could impact the integrity and availability of data managed by COSMOS.
- Arbitrary SQL command execution.
- Potential for data deletion.
- Affects Time-Series Database component.
Attack Path
How an attacker could exploit the issue
An authenticated user could exploit this SQL injection vulnerability in OpenC3 COSMOS by crafting malicious input to the `tsdb_lookup` function. This would allow them to execute arbitrary SQL commands, potentially leading to data deletion or other unauthorized modifications within the time-series database. The impact is amplified by the ability to affect data integrity and availability.
- Requires authenticated access.
- Targets the TSDB component.
- User input is directly used in queries.
Live Threat
Current exploitation, exposure, and threat context
This SQL injection vulnerability in OpenC3 COSMOS, affecting versions between 6.7.0 and before 7.0.0-rc3, allows an authenticated user to execute arbitrary SQL commands by exploiting unsanitized user input in the `tsdb_lookup` function. Attackers would likely find this attractive for data exfiltration or manipulation, especially if the affected database holds sensitive operational data, but the need for prior authentication and the niche nature of the software may limit its widespread appeal.
- SQL injection is a common attack.
- Exploitation requires authentication.
- Software is specialized.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching OpenC3 COSMOS instances, especially if they are exposed externally or accessible by unauthenticated users. This SQL injection vulnerability can allow attackers to execute arbitrary commands and delete data. If patching is delayed, implement strict access controls and network segmentation to limit potential impact.
- Patch to version 7.0.0-rc3.
- Restrict network access to TSDB component.
- Monitor for suspicious SQL queries.
