CVE-2024-46977: OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)
(updated )
A path traversal vulnerability inside of LocalMode’s open_local_file method allows an authenticated user with adequate permissions to download any .txt via the ScreensController#show on the web server COSMOS is running on (depending on the file permissions).
Note: This CVE affects all OpenC3 COSMOS Editions
References
- github.com/OpenC3/cosmos
- github.com/OpenC3/cosmos/commit/a34e61aea5a465f0ab3e57d833ae7ff4cafd710b
- github.com/OpenC3/cosmos/security/advisories/GHSA-8jxr-mccc-mwg8
- github.com/advisories/GHSA-8jxr-mccc-mwg8
- github.com/pypa/advisory-database/tree/main/vulns/openc3/PYSEC-2024-101.yaml
- nvd.nist.gov/vuln/detail/CVE-2024-46977
- rubysec.com/advisories/CVE-2024-46977
- securitylab.github.com/advisories/GHSL-2024-127_GHSL-2024-129_OpenC3_COSMOS
Code Behaviors & Features
Detect and mitigate CVE-2024-46977 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →