Cosmos EUVD-2025-18282

This vulnerability presents a CRITICAL real-world risk despite being classified as HIGH (7.5 CVSS). Analysis of risk signals: (1) CVSS 7.5 with AV:N (network-accessible)/AC:L (low complexity)/PR:N (no privileges)/UI:N (no user interaction) means any unauthenticated attacker on the network can exploit this trivially; (2) Affects confidentiality (C:H) with no integrity/availability impact, meaning data exfiltration is the primary concern; (3) CWE-22 is among the most commonly exploited vulnerability classes in real attacks; (4) COSMOS manages critical space/satellite command infrastructure, making file disclosure potentially catastrophic (could expose operational procedures, encryption keys, or satellite command sequences); (5) The endpoint is part of the core API, likely exposed in typical deployments. While EPSS score data was not provided, similar remote unauthenticated path traversal vulnerabilities typically score 0.85+ EPSS. Lack of authentication requirement elevates this beyond typical internal-only vulnerabilities. This is a priority-1 remediation target for any COSMOS deployment.

An attacker discovers a COSMOS instance exposed on the network (either externally or within a compromised network segment). The attacker crafts HTTP requests to the /openc3-api/tables endpoint with path traversal payloads, such as: GET /openc3-api/tables?table=../../../../etc/passwd or GET /openc3-api/tables?table=../../../opt/openc3/config/database.yml. Since the endpoint lacks authentication and proper input validation, the server processes these requests and returns the contents of arbitrary files readable by the COSMOS process user. The attacker systematically exfiltrates sensitive files including: (1) Application configuration files containing database credentials, API keys, or encryption keys; (2) System files like /etc/passwd or environment variable files that reveal system architecture; (3) Satellite command sequences or operational procedures stored in accessible directories; (4) TLS certificates or SSH keys that could enable lateral movement. This data enables follow-on attacks such as credential compromise, satellite command injection, or infrastructure takeover. No POC was explicitly referenced in provided data, but the trivial nature of directory traversal exploitation (low AC:L) means POC would likely be available or easily developed by threat actors.