Description

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the database_backup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw exec_driver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-06T22:17:42.280Z",
  "pubdate": "2026-08-06T22:17:42.280Z",
  "executiveSummary": "Ground Station prior to 0.6.0 suffers from an unauthenticated database-destruction and arbitrary-data-injection vulnerability residing within the Socket.IO server's database_backup event handler. This critical flaw enables any unauthenticated network peer to completely wipe or replace the entire SQLite database. The vulnerability arises from disabled authentication enforcement combined with a permissive wildcard CORS policy on the Socket.IO server running on port 7000. An attacker with network access can connect without credentials and emit the database_backup event containing a malicious full_restore command with a caller-supplied SQL blob. This triggers the execution of raw SQL statements, dropping all existing tables and permanently destroying essential operational data including satellite records, orbital sources, hardware configurations, and observation schedules. Furthermore, attackers can plant fabricated entries, such as malicious orbital-source URLs and observation schedules, designed to redirect the ground station to attacker-controlled servers upon the next scheduled sync. The business and operational risks are severe, leading to complete loss of data integrity, operational disruption of satellite communications, and potential compromise of connected ground infrastructure.",
  "technicalDetails": "The vulnerability is localized within the Socket.IO server component of Ground Station prior to 0.6.0, specifically listening on network port 7000. The root cause stems from a complete lack of authentication enforcement on socket connections and event handlers, coupled with an overly permissive wildcard Cross-Origin Resource Sharing (CORS) policy. This architectural oversight allows arbitrary, unauthenticated network peers to establish a WebSocket or polling connection to the Socket.IO server without supplying valid credentials or session tokens.\nThe exploitation vector centers on the database_backup event handler exposed by the Socket.IO server. An unauthenticated attacker initiates a network connection to port 7000 and emits the database_backup event, passing a payload that includes a full_restore command accompanied by a caller-supplied SQL blob. Upon receiving this event, the vulnerable application processes the input and executes the attacker-controlled statements using raw exec_driver_sql against the underlying SQLite database without proper validation or sanitization.\nThe step-by-step attack flow proceeds as follows: First, the attacker establishes a network connection to the Socket.IO server on port 7000, bypassing authentication checks due to misconfigured enforcement. Second, the attacker constructs a malicious payload containing the full_restore command along with custom SQL statements, such as DROP TABLE commands followed by malicious CREATE TABLE and INSERT INTO statements. Third, the attacker emits the database_backup event with this crafted payload. Fourth, the server processes the event and executes the raw SQL blob via exec_driver_sql. Finally, the database is purged of all legitimate records and repopulated with attacker-supplied data.\nThe post-exploitation impact includes permanent destruction of critical operational records, including satellite tracking data, orbital sources, hardware configurations, and observation schedules. Additionally, the injection of malicious data allows adversaries to plant fabricated orbital-source URLs and observation entries, effectively hijacking subsequent operations by redirecting the ground station to attacker-controlled infrastructure during the next scheduled synchronization event."
}