Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-28T20:18:29.070Z",
  "pubdate": "2026-08-28T20:18:29.070Z",
  "executiveSummary": "Yamcs is susceptible to a critical remote code execution vulnerability originating from an improper neutralization of special elements in LIKE pattern expressions. The vulnerability exists within the Yarch stream SQL processing logic, specifically in the LikeExpression.fillCode_getValueReturn method. By failing to invoke ValueExpression.escapeJavaString, the system allows arbitrary user-supplied input to be concatenated directly into Java source code before it is dynamically compiled and executed by the server.\nAn unauthenticated or authenticated attacker capable of interacting with specific API endpoints—such as /api/archive/{instance}:executeSql or /api/archive/{instance}/tables/{table}:readRows—can inject malicious Java code by crafting a specially formed LIKE pattern containing quote characters. This allows the attacker to break out of the intended string literal context within the compiled expression, facilitating arbitrary code execution with the privileges of the Yamcs server process. This poses a severe risk of full system compromise, data exfiltration, or unauthorized administrative control over the mission control infrastructure. The issue affects all versions prior to 5.12.8 and 5.13.2.",
  "technicalDetails": "The vulnerability resides in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java. The function fillCode_getValueReturn is responsible for generating Java source code for SQL LIKE clauses during the compilation phase of Yarch stream SQL queries. The root cause is the failure to utilize ValueExpression.escapeJavaString when handling the pattern argument provided in a LIKE expression. Consequently, the user-supplied input is directly embedded into a Java string literal within the dynamically generated source code.\nWhen the Yamcs server receives a request containing a crafted SQL query via endpoints such as POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or various activity search parameters, the provided pattern is passed to the expression compiler. The Expression.getCompiledExpression method subsequently invokes SimpleCompiler.cook to compile the generated Java code into bytecode. By injecting a quote character (e.g., \") into the LIKE pattern, an attacker can prematurely terminate the Java string literal, inject arbitrary Java statements, and use additional syntax to comment out or bypass the remainder of the original generated code.\nThe attack flow follows these steps: 1) The attacker identifies a reachable endpoint that processes Yarch SQL queries or filter criteria. 2) The attacker crafts an input string containing a closing quote, followed by malicious Java code payloads, and potentially a trailing sequence to maintain valid Java syntax. 3) The application processes this input through the vulnerable fillCode_getValueReturn function, resulting in the injection of the malicious payload into the source string. 4) SimpleCompiler.cook compiles this tainted source code. 5) The compiled bytecode is executed by the Java Virtual Machine under the context of the Yamcs service, granting the attacker the effective privileges of the service account. This allows for arbitrary operations, including file system access, network connections, or memory manipulation, leading to a complete compromise of the host environment."
}