Remote Code Execution in MOOS essential-moos pAntler

Executive Summary

This vulnerability is a remote code execution flaw in MOOS essential-moos pAntler through version 10.0.1. It allows unauthenticated attackers to run arbitrary programs by sending a specially crafted MISSION_FILE message to the MOOSDB. The issue occurs because pAntler executes mission files containing malicious Run entries via execvp() without checking authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized MISSION_FILE messages being published to MOOSDB. Check pAntler logs for suspicious Run entries in mission files. Look for unexpected child processes spawned by pAntler via execvp().

Commands: netstat -tulnp | grep MOOSDB to check MOOSDB network activity. ps aux | grep pAntler to inspect running pAntler processes. lsof -p <pAntler_PID> to see file handles and potential malicious files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute malicious code on your system, potentially gaining full control over affected machines. This could lead to data theft, system damage, or unauthorized access to sensitive information. The high CVSS scores (8.1 v3.1, 9.2 v4.0) indicate severe impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update pAntler to the latest version that patches this vulnerability. Restrict network access to MOOSDB to trusted sources only. Disable or firewall the MOOSDB port if not required for operations.

Monitor for unauthorized mission file uploads or suspicious Run entries. Implement strict input validation for mission files. Consider running pAntler in a sandboxed environment to limit potential damage.

Useful 0 Not Useful 0