GHSA-4xqv-47rm-37mm CVE-2024-47529 PYSEC-2024-121
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.35%
- Chance of exploitation in the next 30 days. Higher than 28.97% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-312 Cleartext Storage of Sensitive Information
- CWE-522 Insufficiently Protected Credentials
- Fix
- Available
- 3 packages have a fixed version
Description
Summary
OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).
Note: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition
Impact
This issue may lead to Information Disclosure.
Affected versions
PyPI
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| openc3 | < 5.19.0 |
5.19.0 |
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @openc3/tool-common | < 5.19.0 |
5.19.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
openc3 PyPI → 5.19.0
- pip
pip install --upgrade "openc3>=5.19.0"- poetry
poetry add "openc3>=5.19.0"- uv
uv add "openc3>=5.19.0"
openc3 RubyGems → 5.19.0
- bundler
bundle update openc3 # Gemfile: gem "openc3", ">= 5.19.0"
@openc3/tool-common npm → 5.19.0
- npm
npm install @openc3/tool-common@5.19.0- yarn
yarn add @openc3/tool-common@5.19.0- pnpm
pnpm add @openc3/tool-common@5.19.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it
- Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
- Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How to prevent it
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jjq7-m736-w977 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) | Critical | Also affects openc3 |
| GHSA-vp3w-52v9-q57f OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting | High | Also affects openc3 |
| GHSA-2wvh-87g2-89hr OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool | High | Also affects openc3 |
| GHSA-v529-vhwc-wfc5 OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database | Critical | Also affects openc3 |
| GHSA-ffq5-qpvf-xq7x OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender | Medium | Also affects openc3 |
| GHSA-4jvx-93h3-f45h OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames | Medium | Also affects openc3 |
| GHSA-wgx6-g857-jjf7 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence | High | Also affects openc3 |
| GHSA-w757-4qv9-mghp openc3-api Vulnerable to Unauthenticated Remote Code Execution | Critical | Also affects openc3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor