Description
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
yamcs yamcs
< 5.12.8affected>= 5.13.0, < 5.13.2affected
References
- https://github.com/yamcs/yamcs/security/advisories/GHSA-9272-wg2r-7xmx ↗
- https://github.com/yamcs/yamcs/commit/8e18e279d8ce761c21f4f67bbd06a1bff804d297 ↗
- https://github.com/yamcs/yamcs/commit/ecf34a4e2ccbe085e6ceff0253595b24d5ecb4aa ↗
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8 ↗
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2 ↗