Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Summary

Missing authorization checks on three IAM API endpoints (GET /api/roles, GET /api/roles/{name}, GET /api/privileges) allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a low-privilege account (e.g., a read-only operator) can retrieve the full privilege taxonomy of the server, including the names and assignments of all administrator-level capabilities. This information directly enables targeted privilege escalation attacks.

Details

Three handler methods in IamApi.java serve sensitive security metadata without performing any authorization check:

File: yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java

// Line 73 — GET /api/roles
@Override
public void listRoles(Context ctx, Empty request, ObserverListRolesResponse> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    ListRole> roles = securityStore.getDirectory().getRoles();
    // No ctx.checkSystemPrivilege() call — any authenticated user proceeds
    ...
    observer.complete(responseb.build());
}

// Line 87 — GET /api/roles/{name}
@Override
public void getRole(Context ctx, GetRoleRequest request, ObserverRoleInfo> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    Role role = securityStore.getDirectory().getRole(request.getName());
    // No ctx.checkSystemPrivilege() call
    observer.complete(toRoleInfo(role));
}

// Line 112 — GET /api/privileges
@Override
public void listPrivileges(Context ctx, Empty request, ObserverListPrivilegesResponse> observer) {
    SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
    ListSystemPrivilege> privileges = new ArrayList<>(securityStore.getSystemPrivileges());
    // No ctx.checkSystemPrivilege() call
    observer.complete(responseb.build());
}