Description

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-03T23:17:25.950Z",
  "pubdate": "2026-09-03T23:17:25.950Z",
  "executiveSummary": "MOOS-IvP versions up to 24.8.1 contain a critical directory traversal vulnerability within the SplitHandler component.\nThe vulnerability originates from insufficient input sanitization of variable names extracted from alog files during the splitting process.\nOn Windows systems, an attacker can leverage specially crafted alog files containing path traversal sequences to escape the intended output directory.\nThis flaw enables an arbitrary file write attack, allowing an adversary to append malicious content to sensitive system files or application configurations.\nSuccessful exploitation requires the processing of a maliciously crafted alog file by the victim's MOOS-IvP environment.\nThe impact is significant, potentially leading to unauthorized data modification, system instability, or the achievement of remote code execution if configuration or executable files are targeted.\nThe vulnerability is limited to Windows deployments where backslash-based path manipulation is possible within the underlying file system API.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of string inputs within the SplitHandler component of MOOS-IvP. When parsing alog files, the application extracts variable names to use as identifiers for generated output files.\nThe SplitHandler fails to adequately validate or sanitize these variable names, treating them as trusted input when constructing file system paths. Specifically, the application does not filter for directory traversal sequences, such as backslash (\\) characters or '..' patterns, which are interpreted by the Windows file system API.\nThe attack flow begins when an attacker provides a crafted alog file to a user or system utilizing the MOOS-IvP SplitHandler. Within the metadata or variable naming section of the alog file, the attacker injects malicious sequences, such as '..\\..\\..\\windows\\system32\\drivers\\etc\\hosts'.\nUpon execution of the splitting operation, the SplitHandler concatenates the base output directory with the unsanitized variable name. Due to the lack of path normalization or sanitization, the underlying Windows API resolves these traversal sequences, effectively breaking out of the designated output directory.\nBecause the application is designed to write variable data into files, the process will then append the contents associated with the malicious variable name into the targeted file system path. This allows the attacker to write arbitrary data into files that the process owner has permission to modify.\nThis vulnerability does not require authentication or specific privilege levels beyond those already possessed by the MOOS-IvP user context, though the impact is bounded by the current user's operating system permissions. The attack is effective locally upon the execution of the parsing tool on a malicious file. The behavioral manifestation of this exploit involves the unauthorized appending of data to existing files, which can be leveraged to corrupt logs, modify configuration files, or inject malicious scripts into startup folders or other sensitive locations. The vulnerability is present across all MOOS-IvP versions up to 24.8.1."
}