Ground Station
Monthly
Unauthenticated attackers with network access to a ground-station instance running a version before 0.8.0 can achieve complete application takeover by invoking the setup.restore Socket.IO command while the server is in first-run setup mode. That command was whitelisted as an unauthenticated operation and passed attacker-supplied SQL straight to the application database, letting an attacker plant administrator accounts and forged session tokens and then authenticate as an administrator with no credentials. The flaw is critical severity (CVSS 9.3, CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and is exploitable with no privileges and no user interaction; the practical prerequisite is that the instance must still be in its uninitialized first-run setup state, which makes freshly deployed, re-provisioned, or not-yet-configured servers the realistic targets. This is a pre-authentication total-compromise issue rather than an inflated score; a vendor patch is available in 0.8.0 and no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal file write with an insecure logging-config reload. The unauthenticated save-waterfall-snapshot Socket.IO command lets a remote attacker write attacker-controlled bytes anywhere on disk, then use the equally unauthenticated update-app-config and restart_service commands to load a malicious logging YAML that executes a Python callable factory with service privileges (or forces a persistent crash loop). Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit and advisory describe the full exploit chain.
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly terminate the application process by emitting a single Socket.IO event requiring no credentials. Authentication enforcement is disabled and a wildcard CORS policy is in place, exposing the service_control handler - which triggers process shutdown via a restart_service command - to any host with TCP access to port 7000. In Docker deployments, the attack can be repeated in a loop to sustain a persistent outage of all satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable files outside the intended recordings directory via the Socket.IO configure-sdr command. The sigmf-playback SDR type accepts an unsanitized recordingPath parameter that is stored verbatim and later opened by the sigmfprobe backend, enabling absolute-path or directory-traversal payloads to escape backend/data/recordings and return file contents to the caller. No public exploit has been identified at time of analysis; a vendor-released patch exists as of version 0.4.13.
Unauthenticated attackers with network access to a ground-station instance running a version before 0.8.0 can achieve complete application takeover by invoking the setup.restore Socket.IO command while the server is in first-run setup mode. That command was whitelisted as an unauthenticated operation and passed attacker-supplied SQL straight to the application database, letting an attacker plant administrator accounts and forged session tokens and then authenticate as an administrator with no credentials. The flaw is critical severity (CVSS 9.3, CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and is exploitable with no privileges and no user interaction; the practical prerequisite is that the instance must still be in its uninitialized first-run setup state, which makes freshly deployed, re-provisioned, or not-yet-configured servers the realistic targets. This is a pre-authentication total-compromise issue rather than an inflated score; a vendor patch is available in 0.8.0 and no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal file write with an insecure logging-config reload. The unauthenticated save-waterfall-snapshot Socket.IO command lets a remote attacker write attacker-controlled bytes anywhere on disk, then use the equally unauthenticated update-app-config and restart_service commands to load a malicious logging YAML that executes a Python callable factory with service privileges (or forces a persistent crash loop). Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit and advisory describe the full exploit chain.
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly terminate the application process by emitting a single Socket.IO event requiring no credentials. Authentication enforcement is disabled and a wildcard CORS policy is in place, exposing the service_control handler - which triggers process shutdown via a restart_service command - to any host with TCP access to port 7000. In Docker deployments, the attack can be repeated in a loop to sustain a persistent outage of all satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable files outside the intended recordings directory via the Socket.IO configure-sdr command. The sigmf-playback SDR type accepts an unsanitized recordingPath parameter that is stored verbatim and later opened by the sigmfprobe backend, enabling absolute-path or directory-traversal payloads to escape backend/data/recordings and return file contents to the caller. No public exploit has been identified at time of analysis; a vendor-released patch exists as of version 0.4.13.