A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.
Weakness
The product uses an environment variable to store unencrypted sensitive information.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cosmos | Openc3 | 6.0.0 (including) | 6.0.0 (including) |
Potential Mitigations
References
- https://github.com/OpenC3/cosmos/pull/1816
- https://github.com/OpenC3/cosmos/pull/1816/commits/cce64c213fd2e6a70e2ccbf3622949fe8f9dcaef
- https://github.com/OpenC3/cosmos/releases/tag/v6.0.2
- https://openc3.com/
- https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/