漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Unauthenticated Remote Code Execution in openc3-api
Vulnerability Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using String#convert_to_value. For array-like inputs, convert_to_value executes eval(). Because the cmd code path parses the command string before calling authorize(), an unauthenticated attacker can trigger Ruby code execution even though the request ultimately fails authorization (401). This vulnerability is fixed in 6.10.2.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
动态执行代码中指令转义处理不恰当(Eval注入)
Vulnerability Title
OpenC3 COSMOS 安全漏洞
Vulnerability Description
OpenC3 COSMOS是OpenC3开源的一个应用程序。 OpenC3 COSMOS 5.0.0版本至6.10.1版本存在安全漏洞，该漏洞源于JSON-RPC API中String#convert_to_value对攻击者控制的参数文本解析不当，可能导致未经身份验证的攻击者触发Ruby代码执行。
CVSS Information
N/A
Vulnerability Type
N/A