Description

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-03T23:17:22.353Z",
  "pubdate": "2026-09-03T23:17:22.353Z",
  "executiveSummary": "The MOOS core-moos software, specifically versions through 10.4.0, is susceptible to an improper authentication vulnerability within its message processing architecture. The vulnerability stems from the MOOSDB component's failure to validate the source identity of incoming messages against the authenticated connection session. Instead, the system relies on the source identifier provided within the serialized message payload.\nThis design flaw permits an authenticated attacker to perform message spoofing, effectively impersonating other clients connected to the MOOSDB. By supplying arbitrary source identifiers in the message header, an attacker can manipulate the internal state of the MOOS environment, inject unauthorized data, or terminate active subscriptions belonging to other entities.\nThe impact is significant, as it breaks the fundamental trust model of the MOOS middleware, allowing for unauthorized data manipulation and denial-of-service against specific client subscriptions. Because the vulnerability exists at the protocol processing level, any authenticated client possesses the capability to execute this attack, provided they can communicate with the MOOSDB instance. No elevated system privileges are required to exploit the logic error once the initial connection is established.",
  "technicalDetails": "The vulnerability resides in the MOOSDB message handling logic, which is responsible for routing information between various components in a MOOS community. In MOOS core-moos through 10.4.0, the MOOSDB processes incoming messages by parsing the serialized payload to determine the message origin, rather than deriving the origin identity directly from the underlying socket or authenticated session handle.\nThe root cause is a lack of server-side validation regarding the 'source' attribute in the MOOSMsg structure. When a client connects to the MOOSDB, the server authenticates the connection, but this authentication boundary is not enforced during subsequent message dispatching. The MOOSDB implicitly trusts the 'm_sSrc' field defined within the wire-protocol message packet. Consequently, an attacker can craft a malformed message by specifying an arbitrary string as the source name.\nThe attack flow proceeds as follows: First, the attacker establishes a legitimate connection to the MOOSDB using valid credentials or as an authorized node. Second, the attacker constructs a malicious MOOSMsg object. Within the serialized representation of this message, the attacker manually overrides the source identifier field with the name of a different, legitimate client currently registered with the MOOSDB. Third, the attacker transmits this crafted packet to the MOOSDB. Finally, the MOOSDB receives the packet, parses the attacker-provided source identifier, and distributes the message to all subscribers as if it originated from the victim client.\nThis exploitation method grants the attacker several post-exploitation capabilities. By spoofing the source identity, the attacker can successfully inject data that is accepted by other system components as 'trusted' input from the victim. Furthermore, the attacker can manipulate the MOOSDB's subscription management table. By sending messages that trigger unsubscription requests while spoofing the identity of a target client, the attacker can force the disconnection or silent failure of critical third-party data streams. This facilitates a targeted denial-of-service on specific operational modules within the MOOS architecture. The vulnerability is persistent as long as the MOOSDB allows the source field to be dictated by the client-side payload without secondary validation against the connection registry."
}