Ground Station
Monthly
Unauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal file write with an insecure logging-config reload. The unauthenticated save-waterfall-snapshot Socket.IO command lets a remote attacker write attacker-controlled bytes anywhere on disk, then use the equally unauthenticated update-app-config and restart_service commands to load a malicious logging YAML that executes a Python callable factory with service privileges (or forces a persistent crash loop). Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit and advisory describe the full exploit chain.
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable files outside the intended recordings directory via the Socket.IO configure-sdr command. The sigmf-playback SDR type accepts an unsanitized recordingPath parameter that is stored verbatim and later opened by the sigmfprobe backend, enabling absolute-path or directory-traversal payloads to escape backend/data/recordings and return file contents to the caller. No public exploit has been identified at time of analysis; a vendor-released patch exists as of version 0.4.13.
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly terminate the application process by emitting a single Socket.IO event requiring no credentials. Authentication enforcement is disabled and a wildcard CORS policy is in place, exposing the service_control handler - which triggers process shutdown via a restart_service command - to any host with TCP access to port 7000. In Docker deployments, the attack can be repeated in a loop to sustain a persistent outage of all satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. No public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal file write with an insecure logging-config reload. The unauthenticated save-waterfall-snapshot Socket.IO command lets a remote attacker write attacker-controlled bytes anywhere on disk, then use the equally unauthenticated update-app-config and restart_service commands to load a malicious logging YAML that executes a Python callable factory with service privileges (or forces a persistent crash loop). Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit and advisory describe the full exploit chain.
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable files outside the intended recordings directory via the Socket.IO configure-sdr command. The sigmf-playback SDR type accepts an unsanitized recordingPath parameter that is stored verbatim and later opened by the sigmfprobe backend, enabling absolute-path or directory-traversal payloads to escape backend/data/recordings and return file contents to the caller. No public exploit has been identified at time of analysis; a vendor-released patch exists as of version 0.4.13.
Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly terminate the application process by emitting a single Socket.IO event requiring no credentials. Authentication enforcement is disabled and a wildcard CORS policy is in place, exposing the service_control handler - which triggers process shutdown via a restart_service command - to any host with TCP access to port 7000. In Docker deployments, the attack can be repeated in a loop to sustain a persistent outage of all satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. No public exploit or CISA KEV listing is identified at time of analysis.