Executive Summary

The vulnerability exists in OpenC3 COSMOS versions prior to 6.10.5 and 7.0.0-rc3, where the password change functionality allows a user to change their password without providing the old password. Instead, it accepts a valid session token to authorize the change.

This means that if an attacker has already obtained a valid session token, they can exploit this behavior to change the password of the account associated with that token without knowing the original password.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who has a valid session token to gain persistence in a hijacked account, including accounts with administrative privileges.

By changing the password without needing the old one, the attacker can prevent legitimate users from accessing their accounts, effectively locking them out.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenC3 COSMOS to version 6.10.5 or later, or to version 7.0.0-rc3 or later, where the issue has been patched.

Additionally, in environments where an assumed breach is possible, monitor and restrict access to valid session tokens to prevent attackers from exploiting the password change functionality without the old password.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker who has obtained a valid session token to change the password of an account without knowing the old password, potentially gaining persistent unauthorized access to user accounts, including administrative ones.

Such unauthorized access and persistence can lead to data breaches or unauthorized data manipulation, which may violate common standards and regulations like GDPR and HIPAA that require protection of user data and strict access controls.

Therefore, exploitation of this vulnerability could negatively impact compliance by undermining the confidentiality and integrity requirements mandated by these regulations.

Useful 0 Not Useful 0