Remote Code Execution in MOOS-IvP iSay

The MOOS-IvP (Mission Oriented Operating Suite - Interval Programming) project contains a critical security vulnerability in its iSay component. This component, often used for text-to-speech or notification messaging within the MOOS environment, fails to adequately sanitize input provided through the SAY_MOOS variable. As of version 24.8.1 and earlier, the application passes the contents of this variable directly into a system shell execution context.

An attacker capable of publishing messages to the MOOS community database (DB) can manipulate the SAY_MOOS variable to include shell command substitution characters, such as backticks or "$( )" syntax. When the iSay process parses these malformed messages, the shell interprets the injected sequences as commands, leading to arbitrary code execution under the privileges of the iSay process. This vulnerability is particularly relevant in autonomous vehicle and robotic systems where MOOS-IvP is deployed to facilitate inter-process communication and task coordination.

Attack Chain

1. Attacker gains network access to the MOOS community database (MOOSDB) via the configured MOOS port.
2. Attacker crafts a malicious MOOS message containing shell command injection syntax (e.g., SAY_MOOS = "test \whoami`"`).
3. Attacker publishes the crafted message to the MOOSDB using standard MOOS communication protocols.
4. The iSay process, subscribed to updates on the SAY_MOOS variable, receives the malicious payload.
5. The iSay process passes the payload string to a system execution function (e.g., popen or system) without sanitization.
6. The underlying system shell executes the attacker's injected command.
7. Attacker achieves remote code execution with the permissions of the iSay application.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the host running the iSay process. Given that MOOS-IvP is frequently utilized in unmanned robotic and autonomous surface vehicles, this could lead to full system compromise, exfiltration of telemetry data, or disruption of mission-critical control software.

Recommendation

• Patch the MOOS-IvP environment by updating to a version beyond 24.8.1 once the vendor provides a remediation.
• Implement strict input validation within the MOOSDB gateway to restrict the characters allowed in the SAY_MOOS variable.
• Monitor the iSay process for anomalous child process spawning, such as /bin/sh or /bin/bash executions that originate from the iSay binary.
• Segment the network to ensure that only authorized nodes can publish to the MOOSDB.