An authenticated command injection vulnerability in OpenC3 COSMOS allows attackers to execute arbitrary system commands, posing a critical risk to server integrity and data confidentiality.

This vulnerability involves improper neutralization of special elements used in an OS command (CWE-78). By manipulating the pypi_url setting via the POST /openc3-api/api endpoint, an authenticated user can inject shell metacharacters that are subsequently executed by the application during plugin installation.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the openc3 service user. This level of access grants the attacker control over the application environment, including the ability to exfiltrate Redis data or compromise sensitive bucket credentials. Given the CVSS score of 8.8, this high-severity vulnerability represents a significant risk to organizational infrastructure and data security.

Immediate Action: Update OpenC3 cosmos to version 7.3.0 or later to incorporate the security fix for the plugin installation process.

Proactive Monitoring: Monitor API access logs for suspicious POST requests to the /openc3-api/api endpoint, specifically looking for unusual patterns in configuration settings or plugin installation attempts.

Compensating Controls: Implement strict access control lists to limit the number of users with authenticated access to the application, and employ a Web Application Firewall (WAF) to filter malicious input containing shell metacharacters.

Public Exploit Available: No (exploit_available unknown).

The severity of this command injection vulnerability necessitates immediate attention. Organizations utilizing OpenC3 COSMOS should prioritize upgrading to version 7.3.0 to neutralize the attack vector. While exploitation is not currently confirmed as active in the wild, the presence of a proof-of-concept makes this a high-priority remediation task to prevent potential system compromise.