CVE-2026-55548

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Published

2026-08-28

Modified

2026-08-28

EPSS percentile

29%

Aliases

GHSA-8xjq-pr36-ccgf

Sources

github-advisory

Summary

## Summary The `PacketsApi.exportPackets` endpoint in Yamcs fails to properly enforce object-level privileges (`ReadPacket`) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model. ## Vulnerability Details In `yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java`, the `exportPackets` method processes requests to export raw packets from the `tm` (telemetry archive) table. ```java @Override public void exportPackets(Context ctx, ExportPacketsRequest request, Observer observer) { String instance = InstancesApi.verifyInstance(request.getInstance()); Set nameSet = new HashSet<>(request.getNameList()); ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet); SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME); // ... time filters ... if (request.getNameCount() > 0) { sqlb.whereColIn("pname", nameSet); } String sql = sqlb.toString(); // ... ``` The method attempts to verify privileges using `ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet)`. However, if the `request.getNameList()` is empty (i.e., the attacker does not specify any packet names to filter by), `nameSet` is empty. The `checkObjectPrivileges` method loops over this empty set and successfully passes without throwing a `ForbiddenException`. Since `request.getNameCount()` is 0, no `WHERE pname IN (...)` filter is added to the SQL query. The resulting `sql` query becomes a `SELECT * FROM tm` (with optional time filters). Finally, the query is executed and the results are streamed back to the user: ```java StreamFactory.stream(instance, sql, sqlb.getQueryArguments(), new StreamSubscriber() { @Override public void onTuple(Stream stream, Tuple tuple) { if (observer.isCancelled()) { stream.close(); return; } byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN); HttpBody body = HttpBody.newBuilder() .setData(ByteString.copyFrom(raw)) .build(); observer.next(body); } // ... ``` Crucially, unlike the `streamPackets` or `exportPacket` methods (which explicitly check `ctx.user.hasObjectPrivilege` for each packet retrieved before returning them), the `onTuple` handler in `exportPackets` **blindly streams all retrieved packets to the user without any per-row authorization checks**. Thus, a user who possesses no `ReadPacket` privileges at all can easily bypass authorization and extract all telemetry data from the archive. ## Steps to Reproduce 1. Start the Yamcs server (e.g., using the `simulation` example) with authentication enforced. 2. Log in as a low-privileged user (or use their credentials) who does **not** have the `ReadPacket` privilege. 3. Send an HTTP GET request to the export packets endpoint without specifying any `name` parameters: ```bash curl -v -u low_priv_user:password "http://localhost:8090/api/archive/simulator:exportPackets" -o dumped_packets.raw ``` 4. Observe that the server responds with HTTP `200 OK` and streams all raw packets to the response, saving them to `dumped_packets.raw`. 5. The downloaded file contains raw CCSDS Space Packets (binary telemetry data). 6. Contrast this with an attempt to fetch a specific packet (or calling `listPackets` for an unauthorized packet), which correctly enforces authorization and rejects the request. ## Impact Telemetry packets contain the core mission data, vehicle health statu

Affected packages

Remediation: Upgrade to 5.13.2 or later.

References

• https://github.com/advisories/GHSA-8xjq-pr36-ccgf