Description

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:18:28.657Z",
  "pubdate": "2026-08-28T20:18:28.657Z",
  "executiveSummary": "Yamcs versions prior to 5.9.4 are susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability stemming from improper input sanitization within the authentication flow.\nThe vulnerability allows an unauthenticated or authenticated attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session by manipulating the 'redirect_uri' parameter in the 'GET /auth/authorize' request.\nSuccessful exploitation permits the exfiltration of sensitive browser-held authentication material, such as session cookies or tokens, potentially leading to full account takeover.\nThe impact is significant, as it compromises the confidentiality and integrity of user sessions within the mission control framework.\nExploitation requires the victim to click a crafted, malicious link prepared by the attacker.\nOrganizations using Yamcs are at risk if they have not upgraded to version 5.9.4 or later.",
  "technicalDetails": "The vulnerability resides in the Yamcs authorization process, specifically involving the handling of the 'redirect_uri' parameter. The root cause is the failure of the application to perform adequate HTML escaping on user-provided input before reflecting it back to the user within the 'authorize.html' template.\nThe vulnerability is located in 'yamcs-core/src/main/resources/auth/templates/authorize.html', with the unsafe handling performed by logic within 'yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java' and 'yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java'.\nDuring the authorization process, when a user accesses the 'GET /auth/authorize' endpoint, the application extracts the 'redirect_uri' parameter. Because this parameter is reflected directly into the HTML response without context-aware output encoding or strict validation, an attacker can supply a 'redirect_uri' containing malicious JavaScript payloads (e.g., using 'javascript:' pseudo-protocols or closing HTML tags to inject script blocks).\nThe attack flow proceeds as follows: 1) The attacker constructs a crafted URL targeting the Yamcs '/auth/authorize' endpoint, injecting a payload into the 'redirect_uri' parameter. 2) The attacker lures a victim into clicking the malicious link. 3) The victim's browser sends the request to the Yamcs server. 4) The server processes the request and embeds the malicious 'redirect_uri' content into the response body of 'authorize.html'. 5) The victim's browser receives the response and renders the malicious script, executing it within the security context of the Yamcs application domain.\nOnce the JavaScript executes in the victim's browser, the attacker can leverage the script to access sensitive information, including document cookies (if not protected by HttpOnly flags), local storage, or session identifiers. This information can then be transmitted to an attacker-controlled server. This effectively allows the attacker to hijack the victim's session, bypassing authentication mechanisms and gaining unauthorized access to the Yamcs mission control environment.\nThis vulnerability is classified as a classic reflected XSS vector. It does not require prior authentication to trigger the initial rendering of the payload, although the impact is most severe when targeting authenticated users. The issue was addressed by ensuring proper input sanitization and output encoding within the affected Java classes and HTML templates in version 5.9.4."
}