Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Summary

The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges (ReadPacket) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.

Vulnerability Details

In yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java, the exportPackets method processes requests to export raw packets from the tm (telemetry archive) table.

    @Override
    public void exportPackets(Context ctx, ExportPacketsRequest request, ObserverHttpBody> observer) {
        String instance = InstancesApi.verifyInstance(request.getInstance());

        SetString> nameSet = new HashSet<>(request.getNameList());
        ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet);

        SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME);
        
        // ... time filters ...

        if (request.getNameCount() > 0) {
            sqlb.whereColIn("pname", nameSet);
        }
        String sql = sqlb.toString();
        // ...