Description

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-03T23:17:22.643Z",
  "pubdate": "2026-09-03T23:17:22.643Z",
  "executiveSummary": "The MOOS-IvP uFldShoreBroker application, specifically versions up to 24.8.1, contains a critical input validation vulnerability regarding node ping authentication. The vulnerability exists because the software fails to verify the authenticity of NODE_BROKER_PING messages before processing the associated HostRecord data used for routing bridge variables.\nThis flaw allows a remote attacker to manipulate the bridge configuration of the system. By injecting maliciously crafted NODE_BROKER_PING packets, an adversary can redirect bridged variables to an arbitrary, attacker-controlled destination. This effectively enables unauthorized data interception and potential command injection or manipulation of the inter-node communication flow within a MOOS-IvP architecture.\nThe risk is high for deployments relying on the MOOS-IvP bridge infrastructure, as it breaks the trust model of the communication middleware. Successful exploitation does not require prior authentication, as the broker accepts these messages without validating their source or integrity, allowing an unauthorized actor on the network to reroute sensitive operational data.",
  "technicalDetails": "The vulnerability resides in the core logic of the uFldShoreBroker component, which is responsible for managing inter-node bridges within a MOOS (Mission Oriented Operating Suite) environment. The software is designed to dynamically update routing tables based on incoming NODE_BROKER_PING messages to facilitate communication between distributed IvP Helm nodes.\nThe root cause of this security defect is the absence of cryptographic verification or origin validation for incoming NODE_BROKER_PING messages. When a message is received, the application parses the HostRecord data contained within the payload to establish or update bridge routes. Because uFldShoreBroker trusts these packets implicitly, it blindly follows the instructions contained therein to map local variables to specified remote addresses.\nThe exploitation flow begins with an attacker identifying a network path where they can send UDP or TCP messages to the uFldShoreBroker instance. The attacker crafts a malicious NODE_BROKER_PING message containing a manipulated HostRecord. This record includes the IP address and port of an attacker-controlled listener in place of the legitimate node's destination.\nUpon receipt, the uFldShoreBroker processes the HostRecord and updates its internal routing table. Consequently, all subsequent data destined for the legitimate bridge variables is forwarded to the attacker's infrastructure. This effectively acts as a Man-in-the-Middle (MitM) primitive, where the attacker can capture, modify, or drop MOOS variable updates before they reach their intended recipients.\nThe impact is significant, as uFldShoreBroker is often the gateway for cross-node coordination. By hijacking the variable stream, an attacker can influence the behavior of remote IvP nodes, potentially leading to unauthorized control of autonomous platforms or the compromise of mission-critical data. The vulnerability persists across all versions up to 24.8.1. Given that the system lacks native message-level authentication for this protocol, any entity capable of sending network traffic to the broker can trigger this reconfiguration, necessitating immediate network-level access controls."
}