Description

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T23:17:22.500Z",
  "pubdate": "2026-09-03T23:17:22.500Z",
  "executiveSummary": "The pShare component within the MOOS essential-moos software suite, up to and including version 10.0.1, suffers from an improper authorization vulnerability regarding the processing of PSHARE_CMD messages.\nThe vulnerability allows an unauthenticated, unauthorized publisher on the MOOS network to inject arbitrary configuration commands.\nBy manipulating PSHARE_CMD messages with specific 'input' or 'output' parameters, an attacker can programmatically reconfigure network listeners, modify routing tables, or duplicate sensitive bus traffic to arbitrary network destinations.\nThis flaw exposes the system to potential man-in-the-middle attacks, data exfiltration, and unauthorized network traffic redirection.\nThe risk is critical for deployments where network segmentation or message authentication is not strictly enforced, as an attacker with access to the MOOS community bus can gain control over the pShare infrastructure's communication patterns without needing elevated privileges or prior authentication.\nThe exploitation does not require advanced access beyond the ability to publish messages to the shared MOOS bus, making it highly accessible to any compromised node within the same MOOS community.",
  "technicalDetails": "The vulnerability originates from a failure in the pShare message processing logic to validate the origin and authorization of control commands, specifically those identified as PSHARE_CMD. The application fails to implement an access control mechanism that ensures only authorized or privileged entities can modify the runtime configuration of the pShare process.\nThe pShare process is designed to facilitate the bridging of MOOS messages across different network interfaces or between different MOOS communities. It relies on a command-driven interface to adjust its listeners and routing tables dynamically. In affected versions (10.0.1 and earlier), the implementation treats all incoming PSHARE_CMD messages as trusted commands from legitimate administrative sources.\nThe attack flow begins when an attacker, having gained visibility or connectivity to the MOOS community bus, crafts a malicious PSHARE_CMD packet. By setting the command parameter to either 'input' or 'output', the attacker can trigger the pShare logic responsible for binding to new network sockets or establishing new routing paths.\nStep-by-step exploitation: 1. The attacker identifies the MOOS community bus address and port. 2. The attacker constructs a serialized PSHARE_CMD message containing parameters intended to define a new listener or modify an existing stream. 3. The attacker publishes this message to the bus. 4. The pShare component receives the message and executes the internal command, effectively opening an arbitrary network listener or redirecting traffic. 5. The attacker completes the redirection to an external, attacker-controlled node, facilitating traffic interception or injection.\nThis behavior allows for unauthorized network exposure, as an attacker can force the application to open listening ports on the host system, potentially bypassing firewall rules or security groups. Furthermore, by duplicating traffic through the unauthorized 'output' configuration, the attacker achieves an effective man-in-the-middle position on sensitive inter-process communications, leading to potential data leakage or the ability to inject spoofed commands into the broader MOOS architecture."
}