Summary

COSMOS reads configuration from a user-writable overlay (targets_modified/) before the read-only plugin-installed targets/ tree, and the config subsystem executes code on those files: ConfigParser renders every file as ERB by default, a GENERIC_READ_CONVERSION / GENERIC_WRITE_CONVERSION block is evaluated as code by GenericConversion (Ruby and Python), and the Script Runner suite analysis requires a procedure file. An authenticated user can write into targets_modified/ below the admin tier (the storage-upload endpoint exempts that area from the admin gate, and the screen-save endpoint stores its body verbatim there), so the same root cause is reachable through several features, each giving arbitrary code execution on a COSMOS server.

Three vulnerable routes were identified, all reachable by an authenticated non-admin user (in the open-source edition authorize ignores the permission string, so any authenticated user qualifies):

1. Table definitions (immediate). tables#generate|report|load reads a definition from targets_modified/ and ERB-renders it and evaluates its GENERIC_*_CONVERSION block in the cmd-tlm-api container.

2. Command/telemetry definitions (persistent). A file written to targets_modified/<TARGET>/cmd_tlm/ is overlaid by System.setup_targets and processed by PacketConfig in the decom/multi microservices: ERB-rendered in the Ruby implementation, and GENERIC-evaluated in both the Ruby and Python implementations (the Python ConfigParser does not run ERB). It executes on the next microservice (re)start.

3. Script Runner suites (immediate). A procedure written to targets_modified/<TARGET>/procedures/ is required by the suite analysis, reachable at the read-only script_view tier through scripts#body and running_script#show (the analysis subprocess is spawned when OPENC3_SERVICE_PASSWORD is configured, which it is in the shipped .env).

Impact

Arbitrary code execution as the openc3 user in the cmd-tlm-api container and the per-target decom microservices and the script-runner. Those processes hold the Redis and bucket credentials and sit on the internal service network, so the executed code acts with that authority over configuration, telemetry, and command data across scopes. The API is served through Traefik, which the shipped compose binds to 127.0.0.1:2900, so a default single-host install is reachable only from the host; a multi-user deployment exposes the web port, and the AV:N rating reflects that standard remote-operator exposure.

All paths require valid authentication, and the triggering permissions (system/system_set/script_view) are below the admin/script_run/ lugin-install tiers where COSMOS gates code execution. In the open-source edition authorize checks only token validity and does not enforce the permission string, so any authenticated user can perform these requests.