Description

Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T15:17:17.597Z",
  "pubdate": "2026-11-06T15:17:17.597Z",
  "executiveSummary": "Ground Station, spanning versions 0.6.0 through 0.8.19, contains an improper access control vulnerability within its Socket.IO communication handlers. The vulnerability involves the insufficient restriction of data-retrieval functions, specifically the 'get-orbital-sources' and 'get-tle-sources' handlers, which are inadvertently exposed to non-administrative users. While write-related operations for these sources correctly enforce administrative privileges, the read-based handlers lack similar authorization checks. Consequently, an authenticated operator with lower-level privileges can successfully invoke these handlers to exfiltrate sensitive configuration data. The impact is critical, as the exposure includes plaintext credentials such as usernames, passwords, and API tokens utilized for orbital data source integration. This failure in the authorization model allows unauthorized actors to compromise backend orbital sources, potentially leading to unauthorized data ingestion, service disruption, or further lateral movement within the infrastructure. The vulnerability requires a valid, low-privileged operator account to exploit, posing a significant risk to the integrity and confidentiality of administrative-configured system assets.",
  "technicalDetails": "The vulnerability resides in the authorization logic governing Socket.IO event handlers within the Ground Station application. Specifically, the 'get-orbital-sources' handler (aliased as 'get-tle-sources') fails to validate the authorization level of the requesting user against the system's role-based access control (RBAC) policy. While the application correctly isolates write operations for orbital sources to administrative users, the read-only handlers are globally accessible once an authentication session is established.\nThe attack vector necessitates that an attacker possesses valid credentials for an 'operator' role account. Upon establishing a connection to the Ground Station backend via the Socket.IO protocol, the attacker can emit a request to the vulnerable 'get-orbital-sources' event. Because the application logic does not perform a security check on the requesting user's session role before processing this request, the backend retrieves all configured orbital source data from the database.\nThe payload returned by the server includes sensitive administrative configuration metadata, specifically plaintext credentials and authentication tokens intended for backend authentication against external orbital data providers. By intercepting the Socket.IO response stream, the attacker obtains these secrets, which are not encrypted or masked within the returned object. This bypasses the intended compartmentalization of administrative settings, allowing a non-privileged user to gain visibility into the external systems Ground Station relies upon.\nThe root cause is a deficiency in the middleware layer or event-handler function implementation where access control checks are omitted or inadequately applied to specific endpoints. This disparity between the 'write' handlers, which are restricted, and the 'read' handlers, which are exposed, demonstrates an inconsistent security policy implementation. The vulnerability persists across all versions from 0.6.0 until the release of version 0.8.20, where the authorization checks were reconciled to ensure all administrative sensitive endpoints are protected by appropriate permission validation. The impact extends beyond simple data disclosure, as the exfiltrated tokens/credentials may grant the attacker unauthorized access to external infrastructure or third-party APIs integrated with the Ground Station product, effectively escalating the attacker's footprint outside the application boundary."
}