Summary
OpenC3 COSMOS contains a stored cross-site scripting vulnerability in shared screen button actions, allowing an authenticated user with system_set permission to store script content that executes in another operator's browser session. When activated, the script may read the victim's bearer token from local storage, potentially enabling account takeover and actions with the victim's privileges.
Affected context
The issue occurs in COSMOS deployments using shared screens and the BUTTON widget. It becomes risky when an authenticated actor has system_set permission, can create or modify shared screen content, and another operator views and activates the affected button in a browser session. The permissive content security policy may make script execution easier, but unsafe handling of stored widget actions is the primary concern.
Exploit preconditions
- Attack surface: The shared-screen API and browser-based COSMOS operator interface
- Required access: An authenticated account with
system_setpermission - Trigger point: A victim activates a stored BUTTON widget in another operator's browser session
- Required victim condition: The victim must access the affected shared screen and interact with the button
- Why exploitation is possible: Stored widget action content is evaluated in the COSMOS origin without sufficiently separating data from executable browser code
Why this happens
The vulnerability is caused by treating stored BUTTON widget actions as executable content in an operator's browser context. This permits attacker-controlled data persisted through the shared-screen feature to execute with the privileges and origin of the viewing session. The behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting. Access to browser storage containing bearer tokens increases the impact, while the content security policy is a contributing control weakness rather than the primary root cause.
Potential impact
- An attacker may execute JavaScript in another operator's COSMOS origin
- A victim's bearer token could be exposed
- The attacker could take over the victim's account or session
- Actions could be performed with the victim's permissions
- Operational data or embedded-system commands could be accessed or affected
General mitigation guidance
Mitigation generally focuses on ensuring that stored screen configuration remains data rather than executable browser code.
Common defensive patterns include:
- Rendering widget actions through strict allowlisted commands instead of evaluating arbitrary script content
- Applying context-aware output encoding and sanitization before displaying persisted values
- Validating shared-screen schemas on the server and rejecting unexpected action types or fields
- Reducing the ability of broad-privilege accounts to create or modify shared screens
- Protecting bearer tokens from browser-readable storage where practical and using narrowly scoped, short-lived credentials
- Enforcing a restrictive, nonce- or hash-based content security policy as defense in depth
- Applying least privilege to operator accounts and separating screen-authoring permissions from operational control permissions
How teams detect issues like this
Detection approaches may include:
- Static analysis rules for DOM sinks, JavaScript evaluation, and dynamic compilation in widget components
- Code review checks for persisted values reaching HTML, script, event-handler, or template execution contexts
- Server-side policy checks that restrict shared-screen actions to a documented allowlist
- Runtime monitoring for unusual shared-screen creation or modification by privileged accounts
- Browser security telemetry for unexpected script execution or token-access behavior
- Automated security review tools that identify stored XSS data flows and overly permissive content security policies
