Unauthenticated Denial of Service in Ground Station

Ground Station software versions prior to 0.6.0 contain a critical vulnerability in the Socket.IO server implementation, specifically within the service_control event handler. This flaw allows any unauthenticated network peer to send a restart_service command to the Socket.IO server, which is configured to listen on TCP port 7000. Due to a combination of missing authentication enforcement and a wildcard Cross-Origin Resource Sharing (CORS) policy, the service accepts and executes the restart command from unauthorized sources. Successful exploitation triggers an immediate termination of the ground-station process, resulting in the loss of all active satellite-tracking sessions, SDR (Software Defined Radio) recording pipelines, signal demodulators, decoders, and hardware rotator controllers. In Docker-based deployments, where containers are often configured to restart automatically upon process failure, an attacker can continuously emit this command to establish a persistent denial-of-service state.

Impact

The vulnerability poses a severe risk to satellite operations and data integrity. By forcibly terminating the ground-station process, attackers can cause significant operational downtime, interrupting real-time satellite telemetry, SDR data ingestion, and mission-critical tracking tasks. In scenarios where containers are automatically restarted, the persistence of this attack renders the affected infrastructure entirely unavailable for legitimate commands, potentially leading to total loss of communications or orbital control capabilities during critical windows.

Recommendation

1. Upgrade all instances of Ground Station to version 0.6.0 or later immediately to patch the insecure event handler and correct the authentication logic.
2. Implement network-layer access controls (e.g., firewall rules or VPC security groups) to restrict inbound traffic to TCP port 7000 to only known, trusted administrative IP addresses.
3. Reconfigure the Socket.IO server CORS policy to explicitly define authorized origins rather than using a wildcard, preventing cross-origin exploitation attempts.