MOOS Core-MOOS Unauthenticated Privilege Escalation via Wire Protocol

Executive Summary

MOOS core-moos through version 10.4.0 has a lack of authentication in its wire protocol. This allows unauthenticated clients to connect with full privileges, including publishing, subscribing, and clearing the database. Attackers can bypass protocol checks and use arbitrary client names to perform privileged operations like DB_CLEAR, which resets all variables and clears client mail queues.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated connections to MOOS core-moos services. Monitor network traffic for unexpected client connections or DB_CLEAR operations. Inspect logs for clients with arbitrary names bypassing protocol checks. Use tools like netstat, ss, or tcpdump to identify active connections to MOOS ports (default 9000).

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full control over the MOOS system, disrupt operations by clearing critical data, or intercept and manipulate communications. This could lead to system downtime, data loss, or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update MOOS core-moos to a patched version beyond 10.4.0. Restrict network access to MOOS services using firewalls or network segmentation. Disable unauthenticated connections if possible. Monitor for suspicious DB_CLEAR operations or unauthorized client connections. Consider disabling the wire protocol if not required.

Useful 0 Not Useful 0