Remote Code Execution in MOOS essential-moos pAntler

The MOOS-IvP open-source project essential-moos suite, specifically the pAntler component through version 10.0.1, contains a critical remote code execution vulnerability. pAntler is designed to manage and launch various MOOS processes defined within a mission file. An unauthenticated attacker capable of communicating with the MOOSDB can publish a specially crafted 'MISSION_FILE' message. The pAntler application reads the contents of this message and parses it for 'Run' entries. Due to a lack of authentication and input validation on these entries, pAntler passes the user-supplied strings directly to the execvp() system call, resulting in the execution of arbitrary programs with the privileges of the pAntler process. This vulnerability is significant for autonomous systems and research platforms that utilize the MOOS-IvP architecture, as it allows for full command execution on the host machine.

Attack Chain

1. Attacker establishes network connectivity to the target MOOSDB port.
2. Attacker crafts a malicious MISSION_FILE message containing arbitrary commands within 'Run' entries.
3. Attacker publishes the crafted message to the MOOSDB via the MOOS protocol.
4. The pAntler component receives the malicious MISSION_FILE message from the MOOSDB.
5. pAntler parses the 'Run' entries within the message without validating the input.
6. pAntler calls the execvp() system call, passing the malicious entries.
7. The operating system executes the attacker-defined program on the host.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary programs on systems running affected versions of essential-moos. This can lead to full system compromise, loss of control over autonomous mission software, and data exfiltration. The vulnerability affects research and robotics environments utilizing the MOOS-IvP middleware.

Recommendation

1. Upgrade the essential-moos software to a version beyond 10.0.1 immediately, if available, or isolate MOOSDB instances from untrusted network segments.
2. Implement network access controls (NAC) to restrict communication with the MOOSDB port to authorized and authenticated mission components only.
3. Audit environments for the use of pAntler and ensure process execution policies are configured to minimize the impact of unauthorized sub-process spawning.