Advisories – Page 3 – VisionSpace

How to crash a Spacecraft – DoS through Vulnerability in NASA CryptoLib v1.3.0

Advisories, Cybersecurity, Space, TechnologyAugust 21, 20242KViewsShareTwitter FacebookEmailLink

CryptoLib, a software library developed by NASA, implements the CCSDS Space Data Link Security Protocol (SDLS) to secure communications between spacecraft running the Core Flight System (cFS) and their corresponding ground stations. The library is essential in safeguarding the integrity and confidentiality of data exchanged during space missions.

Ground Control to Major Threat: Hacking the Space Link Extension Protocol

Advisories, Cybersecurity, Space, TechnologyAugust 9, 20242KViewsShareTwitter FacebookEmailLink

Space missions have increasingly been the subject of security breaches and satellite hacks. Most discussions revolve around direct communication and access to spacecraft through means such as Software Defined Radio. However, the reality is that this approach isn’t practical for most adversaries, as it requires substantial resources and is easily detectable due to the power…

Exploiting the Apache Karaf Console

Advisories, Cybersecurity, TechnologyJanuary 16, 20241KViewsShareTwitter FacebookEmailLink

Apache Karaf is an open-source container that simplifies the deployment and management of enterprise applications based on the OSGi (Open Services Gateway Initiative) standard. OSGi is a modular architecture that allows developers to build and deploy highly modular, dynamic, and scalable applications. Apache Karaf builds upon the strengths of OSGi, providing a lightweight and flexible…

Exploitation of the OSGi console

Advisories, Cybersecurity, TechnologyJanuary 12, 20241KViewsShareTwitter FacebookEmailLink

The OSGi Console provides a management console that, if misconfigured, can be exploited by an attacker, leading to Remote Code Execution (RCE). While conducting this assessment activity, the following versions of Eclipse Equinox and OSGi bundle have successfully been exploited: Eclipse Equinox 3.7.2 and below / OSGi 3.7.2 and below Eclipse Equinox 3.8 to 4.28 / OSGi…

XSS in NASAs Open MCT v3.1.0

Advisories, Cybersecurity, Space, TechnologyNovember 2, 20231KViewsShareTwitter FacebookEmailLink

We continued our review of NASA’s Open MCT software (v3.1.0) and discovered a stored Cross-Site Scripting (XSS) vulnerability. Its impact can be significant since the examined version lacks CSP flags and CSRF protection. Two new CVEs have been assigned and are discussed in this report: - XSS: CVE-2023-45885 - CSRF: CVE-2023-45884 Stored XSS The…

Yamcs v5.8.6 Vulnerability Assessment

Advisories, Cybersecurity, Space, TechnologyOctober 13, 20231KViewsShareTwitter FacebookEmailLink

Yet Another Mission Control System (Yamcs v5.8.6) is an open-source software framework for the command and control of spacecraft, satellites, payloads, ground stations and ground equipment developed by Space Applications Services. Given that the software provides a wide range of monitoring and control capabilities and is used/supported by many public and private organisations (such as…